{"openapi":"3.0.0","info":{"title":"ThreatDown APIs","description":"ThreatDown API lets you remotely manage the security of your `Endpoints`, analyze their `assets`, perform advanced analysis on `Detections` of `Malware`, `Ransomware`, `Exploits` and other threats found by the `ThreatDown Endpoint Agent`, and issue jobs like `Scan`, `Isolate`, `Remediate` or `Reboot`.\n\nYou can also subscribe to security `Webhooks` events and have your application notified when something happens, like the `Detection` of a new threat.\n\nThe ThreatDown API provides you with all you need to remotely manage the security of your company's devices from your code, and to integrate ThreatDown's protection into your custom security's workflows and pipelines.\n\n# Introduction\n\nTo get started, you need a client credential pair (OAuth2 application). You can get a valid application through our sales team. Along with a `client_id` and `client_secret` pair, you need a valid `master license`.\n\n## Cross-Origin Resource Sharing\n\nThis API features Cross-Origin Resource Sharing (CORS) implemented in compliance with [W3C spec](https://www.w3.org/TR/cors/).\nThis allows cross-domain communication from the browser.\nAll responses have a wildcard same-origin which makes them completely public and accessible to everyone, including any code on any site.\n\n## Authentication\n\nThreatDown API uses OAuth2, an open protocol to allow secure authorization in a simple and standard method from web, mobile, and desktop applications.\nSee the Authentication section for specific information about supported grants.\n\n## Access' scopes\n\nWhen creating a new application, you can decide the level of access it has to your account's data. This utility allows you to restrict the scope of access to your account's data depending on the application's needs. For example, if you only need to analyze detections found on your endpoint, the read scope will be enough to prevent that application from modifying data or issuing jobs.\n\nSpecifying access scopes gives you more control over the access of your data. For example, you may want your company's IT department to be able to isolate infected endpoints, while you may want your analysts to only read data for generating reports. To do so, you can create two applications using different scopes, and provide the right people with the right pair of credentials for programmatic access.\n\n## User permissions\n\nThe user associated with the client (i.e. the user that created the OAuth2 application) must have the required permissions to perform the requested operation. If the user does not have sufficient permissions, the API will respond with a `403 Forbidden` status code.\nFor each API, you can find the required permissions in the AUTHORIZATIONS dropdown, under `user_permissions`.\n\nSome API requires additional permissions based on the data in the body:\n- **jobs** issue API requires `<entity>.performActions` depending on the `command` (\\<entity\\> can be `endpoints`, `softwareInventory`, or `detections`)\n- **notifications** create/update API requires `<entity>.view` depending on the `category`\n- **reports** create/update API requires `<entity>.view` depending on the `type`\n\n## Rate Limiting\n\nThreatDown API implements a rate-limiting mechanism to prevent abuse. The rate-limiting mechanism is implemented using a leaky bucket algorithm. Once you exceed the available limit, our server will respond with a `429` status code. You can throttle your requests and retry them later.\n\nThe current limit, which you can see in the table below, has shown to be enough for most use cases. If you encounter `429` error codes, consider taking the following actions to minimize your APIs usage:\n\n- Subscribe to webhooks events instead of polling the API for reacting to changes.\n- Throttle the requests you send to the ThreatDown API for not exceeding the limit.\n- Batch requests when possible.\n- Contact us and request to increase the API quota for your application.\n\nCurrently, the default available quota is `360` requests per minute.\n","version":"1.0.0"},"tags":[{"name":"V2 (RMM) Accounts"},{"name":"V2 (RMM) Assets"},{"name":"V2 (RMM) Detections"},{"name":"V2 (RMM) Endpoints"},{"name":"V2 (RMM) Events"},{"name":"V2 (RMM) Exclusions"},{"name":"V2 (RMM) Flight-recorder"},{"name":"V2 (RMM) Groups"},{"name":"V2 (RMM) Installers"},{"name":"V2 (RMM) Jobs"},{"name":"V2 (RMM) Licensing"},{"name":"V2 (RMM) Notifications"},{"name":"V2 (RMM) OS Patches"},{"name":"V2 (RMM) Policies"},{"name":"V2 (RMM) Preferences"},{"name":"V2 (RMM) Remediation"},{"name":"V2 (RMM) Sa"},{"name":"V2 (RMM) Schedules"},{"name":"V2 (RMM) Users"},{"name":"V2 (RMM) Vulnerability Management"},{"name":"V2 (RMM) Webhooks"},{"name":"V2 (legacy) Authentication"},{"name":"V2 (legacy) accounts"},{"name":"V2 (legacy) applications"},{"name":"V2 (legacy) cve"},{"name":"V2 (legacy) detections"},{"name":"V2 (legacy) endpoints"},{"name":"V2 (legacy) events"},{"name":"V2 (legacy) exclusions"},{"name":"V2 (legacy) integrations"},{"name":"V2 (legacy) jobs"},{"name":"V2 (legacy) policies"},{"name":"V2 (legacy) sa"},{"name":"V2 (legacy) scans"},{"name":"V2 (legacy) webhooks"},{"name":"oauth"}],"servers":[{"url":"https://api.threatdown.com"},{"url":"https://nebula-retina-mb-stage.eng-prod.mb-internal.com"},{"url":"https://nebula-retina-mb-qa.eng-dev.mb-internal.com"},{"url":"https://nebula-retina-mb-dev.eng-dev.mb-internal.com"}],"paths":{"/api/v2/auth/initiate":{"get":{"status":{"outage":["oauth2"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"email","required":true,"in":"query","description":"The Filter_type Schema","schema":{"type":"string","pattern":"[a-z0-9\\._%+!$&*=^|~#%{}/\\-]+@([a-z0-9\\-]+\\.){1,}([a-z]{2,22})"}},{"name":"login_challenge","required":false,"in":"query","description":"The login_challenge Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) Authentication"],"operationId":"api.auth.get.initiate"}},"/api/v2/auth/consent/initiate":{"get":{"status":{"outage":["oauth2"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"consent_challenge","required":true,"in":"query","description":"The login_challenge Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) Authentication"],"operationId":"api.auth.get.consent.initiate"}},"/api/v2/login":{"get":{"status":{"outage":["oauth2"]},"parameters":[{"name":"token","required":true,"in":"query","description":"Token obtained with POST -> /accounts/:account_id/users/:user_id/signin_link","schema":{"type":"string"}},{"name":"redirect","required":false,"in":"query","description":"Force recirect to a specified url","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) Authentication"],"operationId":"api.admin.login"}},"/api/v2/auth/complete":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["oauth2","auth"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Initiate auth body Schema","required":["login_challenge"],"properties":{"login_challenge":{"type":"string","title":"The login_challenge Schema"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) Authentication"],"operationId":"api.auth.post.complete"}},"/api/v2/auth/reject":{"post":{"status":{"outage":["oauth2"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The reject auth body Schema","required":["login_challenge"],"properties":{"login_challenge":{"type":"string","title":"The login_challenge Schema"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) Authentication"],"operationId":"api.auth.post.reject"}},"/api/v2/auth/consent/accept":{"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["oauth2","auth"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The accept consent body Schema","required":["consent_challenge"],"properties":{"consent_challenge":{"type":"string","title":"The login_challenge Schema"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) Authentication"],"operationId":"api.auth.accept.accept"}},"/api/v2/auth/consent/reject":{"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["oauth2","auth"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The reject consent Schema","required":["consent_challenge"],"properties":{"consent_challenge":{"type":"string","title":"The login_challenge Schema"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) Authentication"],"operationId":"api.auth.put.consent.reject"}},"/api/v2/endpoints":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$"}},{"name":"filter_type","required":false,"in":"query","description":"The Filter_type Schema","schema":{"type":"string","pattern":"^(.*)$"}},{"name":"sort","required":false,"in":"query","description":"The Sort Schema","schema":{"type":"string","pattern":"^-?\\w{1,}$"}},{"name":"group_id","required":false,"in":"query","description":"The Group_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"search_string","required":false,"in":"query","description":"The Search_string Schema","schema":{"type":"string"}},{"name":"status_filter","required":false,"in":"query","description":"The Status_filter Schema","schema":{"type":"integer"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoints Body 200 Schema","required":["machines","total_count"],"properties":{"machines":{"type":"array","title":"The Machines Schema","items":{"type":"object","title":"The Items Schema","required":["created_at","id","last_seen_at","name","online","os_architecture","os_platform","os_release_name"],"properties":{"created_at":{"type":"string","title":"The Created_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"last_seen_at":{"type":"string","title":"The Last_seen_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"name":{"type":"string","title":"The Name Schema","pattern":"^(.*)$"},"online":{"type":"boolean","title":"The Online Schema"},"os_architecture":{"type":"string","title":"The Os_architecture Schema"},"os_platform":{"type":"string","title":"The Os_platform Schema"},"os_release_name":{"type":"string","title":"The Os_release_name Schema"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoints"},"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"incident":["read_nebula_data","caching"],"outage":["auth","search_stateful"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"PostEndpoints","additionalProperties":true,"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"The Schema"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match)"},"alias":{"type":"string","title":"Aliases for the machine"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"suspicious_activity_found":{"type":"boolean","title":"The Schema"},"reboot_required":{"type":"boolean","title":"The Schema"},"infection_found":{"type":"boolean","title":"The Schema"},"policy_id":{"type":"string","title":"The Schema"},"policy_name":{"type":"string","title":"The Schema"},"policy_etag":{"type":"string","title":"The Schema"},"domain_name":{"type":"string","title":"The Schema"},"engine_version":{"type":"string","title":"The Schema"},"plugins.siem.reboot_reason":{"type":"string","title":"The Schema"},"plugins.siem.plugin_version":{"type":"string","title":"The Schema"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"The Schema"},"plugins.incident_response.reboot_reason":{"type":"string","title":"The Schema"},"plugins.incident_response.plugin_version":{"type":"string","title":"The Schema"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"The Schema"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"The Schema"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"The Schema"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"The Schema"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"The Schema"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"The Schema"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"The Schema"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"The Schema"},"plugins.asset_manager.plugin_version":{"type":"string","title":"The Schema"},"fully_qualified_host_name":{"type":"string","title":"The Schema"},"host_name":{"type":"string","title":"The Schema"},"os_info.os_release_name":{"type":"string","title":"The Schema"},"os_info.os_architecture":{"type":"string","title":"The Schema"},"os_info.os_platform":{"type":"string","title":"The Schema"},"os_info.os_version":{"type":"string","title":"The Schema"},"os_info.os_type":{"type":"string","title":"The Schema"},"nics.description":{"type":"string","title":"The Schema"},"nics.mac_address":{"type":"string","title":"The Schema"},"nics.ips":{"type":"string","title":"The Schema"},"group_name_partial":{"type":"string","title":"The Schema"},"policy_name_partial":{"type":"string","title":"The Schema"},"host_name_partial":{"type":"string","title":"The Schema"},"fully_qualified_host_name_partial":{"type":"string","title":"The Schema"},"engine_version_partial":{"type":"string","title":"The Schema"},"domain_name_partial":{"type":"string","title":"The Schema"},"group_id":{"type":"string","title":"The Schema"},"group_name":{"type":"string","title":"The Schema"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"The populate object Schema","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"default_group":{"type":"boolean","title":"Specify whether the group is default"}}},"page_size":{"type":"number","title":"The page_size Schema","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"subaccounts":{"type":"array","title":"The Subaccounts Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","default":[],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"The Status_filter Schema","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The Next_cursor Schema"},"after":{"type":"string","title":"The after Schema"},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"Deleted at after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"Deleted at before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan  before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The POST Endpoints Body 200 Schema","required":["machines","total_count","next_cursor"],"properties":{"aggregations":{"type":"object","additionalProperties":true},"machines":{"type":"array","title":"The Machines Schema","items":{"type":"object","title":"The Items Schema","additionalProperties":true,"properties":{"link":{"type":"string","title":"The Link Schema"},"protection_status":{"type":"string","title":"Protection Status"},"display_name":{"type":"string","title":"Display Name"},"agent":{"type":"object","title":"The Agent Schema","additionalProperties":true,"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"last_user":{"type":"string","title":"The last user logging in"},"at":{"type":"string","title":"The At Schema"},"machine_id":{"type":"string","title":"The Machine_id Schema"},"account_id":{"type":"string","title":"The Account_id Schema"},"group_id":{"type":"string","title":"The Group_id Schema"},"nics":{"type":"array","title":"The Nics Schema","items":{"type":"object","title":"The Items Schema","properties":{"ips":{"type":"array","title":"The Ips Schema","items":{"type":"string","title":"The Items Schema"}},"description":{"type":"string","title":"The Description Schema"},"mac_address":{"type":"string","title":"The Mac_address Schema"}}}},"os_info":{"type":"object","title":"The Os_info Schema","properties":{"os_type":{"type":"string","title":"The Os_type Schema"},"os_version":{"type":"string","title":"The Os_version Schema"},"os_platform":{"type":"string","title":"The Os_platform Schema"},"os_architecture":{"type":"string","title":"The Os_architecture Schema"},"os_release_name":{"type":"string","title":"The Os_release_name Schema"}}},"domain_name":{"type":"string","title":"The Domain_name Schema"},"host_name":{"type":"string","title":"The Host_name Schema"},"fully_qualified_host_name":{"type":"string","title":"The Fully_qualified_host_name Schema"},"object_guid":{"type":"string","title":"Object guid"},"plugins":{"type":"object","title":"The Plugins Schema","properties":{"incident_response":{"type":"object","title":"The Incident_response Schema","properties":{"product_name":{"type":"string","title":"The Product_name Schema"},"plugin_version":{"type":"string","title":"The Plugin_version Schema"},"update_package_version":{"type":"string","title":"The Update_package_version Schema"},"component_package_version":{"type":"string","title":"The Component_package_version Schema"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_protection":{"type":"object","title":"Endpoint protection plugin","properties":{"sdk_version":{"type":"string","title":"SDK version plugin"},"product_name":{"type":"string","title":"Name of the product"},"plugin_version":{"type":"string","title":"Version of the product"},"update_package_version":{"type":"string","title":"Update version"},"component_package_version":{"type":"string","title":"Component version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"asset_manager":{"type":"object","title":"The Asset_manager Schema","properties":{"product_name":{"type":"string","title":"The Product_name Schema"},"plugin_version":{"type":"string","title":"The Plugin_version Schema"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_detection_and_response":{"type":"object","title":"The Endpoint_detection_and_response Schema","properties":{"product_name":{"type":"string","title":"The Product_name Schema"},"plugin_version":{"type":"string","title":"The Plugin_version Schema"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}}}},"engine_version":{"type":"string","title":"The Engine_version Schema"},"policy_etag":{"type":"string","title":"The Policy_etag Schema"},"version":{"type":"integer","title":"The Version Schema"},"document_id":{"type":"string","title":"The Document_id Schema"},"machine_ip":{"type":"string","title":"Machine public IP"},"source_location":{"type":"object","properties":{"city":{"type":"string"},"country":{"type":"string"},"country_iso":{"type":"string"},"continent":{"type":"string"},"accuracy_radius":{"type":"integer"},"point":{"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number"}]},"lon":{"allOf":[{"bignumber":true},{"type":"number"}]}}},"time_zone":{"type":"string"},"postal_code":{"type":"string"},"subdivisions":{"type":"array","items":{"type":"string"}},"anonymous_proxy":{"type":"boolean"}}},"serial_number":{"type":"string","title":"Serial number of this machine"}}},"machine":{"type":"object","title":"The Machine Schema","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id Schema"},"job":{"type":"object","title":"The last job Schema","additionalProperties":true},"account":{"type":"object","title":"The last job Schema","additionalProperties":true},"online":{"type":"boolean","title":"The online Schema"},"account_id":{"type":"string","title":"The Account_id Schema"},"group_id":{"type":"string","title":"The Group_id Schema"},"root_group_id":{"type":"string","title":"The Root_group_id Schema"},"group_name":{"type":"string","title":"The Group_name Schema"},"policy_id":{"type":"string","title":"The Policy_id Schema"},"policy_account_id":{"type":"string","title":"The Policy_account_id Schema"},"policy_name":{"type":"string","title":"The Policy_name Schema"},"last_day_seen":{"type":"string","title":"The Last_day_seen Schema"},"last_active":{"type":"string","title":"Last time the endpoint connected to Nebula in real time"},"isolated":{"type":"boolean","title":"The Isolated Schema"},"scan_age_days":{"type":"integer","title":"The Scan Age Days Schema"},"suspicious_activity_count":{"type":"integer","title":"The Suspicious_activity_count Schema"},"infection_count":{"type":"integer","title":"The Infection_count Schema"},"reboot_required":{"type":"integer","title":"The Reboot_required Schema"},"last_scanned_at":{"type":"string","title":"The Last_scanned_at Schema"},"is_deleted":{"type":"boolean","title":"The Is_deleted Schema"},"version":{"type":"integer","title":"The Version Schema"},"document_id":{"type":"string","title":"The Document_id Schema"},"created_at":{"type":"string","format":"date-time","title":"Created At"}}},"machineVersion":{"type":"integer","title":"The Machineversion Schema"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"after":{"type":"string","title":"The Next_cursor Schema"}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.search.endpoints"}},"/api/v2/endpoints/{id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoint By Id Body 200 Schema","required":["id","name","online","os_architecture","os_platform","os_release_name","last_seen_at","created_at"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"The Name Schema"},"online":{"type":"boolean","title":"The Online Schema"},"os_architecture":{"type":"string","title":"The Os_architecture Schema"},"os_platform":{"type":"string","title":"The Os_platform Schema"},"os_release_name":{"type":"string","title":"The Os_release_name Schema"},"last_seen_at":{"type":"string","title":"The Last_seen_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at":{"type":"string","title":"The Created_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id"}},"/api/v2/endpoints/{id}/agent_info":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Agent Info of Endpoint Body 200 Schema","additionalProperties":true,"properties":{"nics":{"type":"array","title":"NICs","additionalItems":true,"items":{"type":"object","title":"NICs items","additionalProperties":true,"properties":{"ips":{"type":"array","title":"IPs schema","default":[],"examples":[["10.151.110.219"]],"additionalItems":true,"items":{"type":"string","title":"IP"}},"description":{"type":"string","title":"Description","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"MAC address","examples":["000C29DD431E"]}}}},"os_info":{"type":"object","title":"OS info","default":{},"additionalProperties":true,"properties":{"os_type":{"type":"string","title":"OS type","examples":["Server"]},"os_version":{"type":"string","title":"OS version","examples":["10.0.14393"]},"os_platform":{"type":"string","title":"OS platform","examples":["Windows"]},"os_architecture":{"type":"string","title":"OS architecture","examples":["Amd64"]},"os_release_name":{"type":"string","title":"OS release name","examples":["Microsoft Windows Server 2016 Standard"]}}},"plugins":{"type":"array","title":"Plugins","default":[],"additionalItems":true,"items":{"type":"object","title":"Plugin items","default":{},"properties":{"product_name":{"type":"string","title":"Product name","examples":["Endpoint Detection and Response"]},"sdk_version":{"type":"string","title":"SDK version","examples":["3.7.1.2840"]},"plugin_version":{"type":"string","title":"Plugin version","examples":["1.2.0.289"]},"update_package_version":{"type":"string","title":"Update package version","examples":["3.1.4.1"]},"component_package_version":{"type":"string","title":"Component package version","examples":["1.0.545"]},"desktop_isolation":{"type":"string","title":"Desktop isolation","examples":["False"]},"network_isolation":{"type":"string","title":"Network isolation","examples":["False"]},"process_isolation":{"type":"string","title":"Process isolation"},"reboot_reasons":{"type":"integer","title":"Reboot reasons"},"medrnet_version":{"type":"string","title":"Medrnet version","examples":["1.13.0.0"]},"frcore_version":{"type":"string","title":"FR Core version","examples":["1.8.1.152"]},"alerts":{"type":"object","title":"Alerts","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}}},"host_name":{"type":"string","title":"Host name","examples":["CJR-2016-RDS-ESXi"]},"last_user":{"type":"string","title":"last user","examples":["ONEVIEW\\ovadmin"]},"domain_name":{"type":"string","title":"Domain name","examples":["nebula.qa"]},"policy_etag":{"type":"string","title":"Policy etag","examples":["943695dd5fb09047802c6ddbf87883bf"]},"engine_version":{"type":"string","title":"Engine version","examples":["1.2.0.778"]},"dhcp_scope_name":{"type":"string","title":"DHCP scope name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified host name","examples":["CJR-2016-RDS-ESXi.nebula.qa"]},"last_seen_at":{"type":"string","title":"last seen at","examples":["2020-04-24T20:02:37.989756Z"]},"agent_info_last_updated_at":{"type":"string","title":"Agent info last updated at","examples":["2020-04-24T19:04:20.600724Z"]},"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"source_location":{"type":"object","properties":{"city":{"type":"string"},"country":{"type":"string"},"country_iso":{"type":"string"},"continent":{"type":"string"},"accuracy_radius":{"type":"integer"},"point":{"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number"}]},"lon":{"allOf":[{"bignumber":true},{"type":"number"}]}}},"time_zone":{"type":"string"},"postal_code":{"type":"string"},"subdivisions":{"type":"array","items":{"type":"string"}},"anonymous_proxy":{"type":"boolean"}}}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.agent_info"}},"/api/v2/endpoints/{id}/assets":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Assets Body 200 Schema","type":"object","properties":{"startups":{"type":"array","title":"The startup programs","items":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"},"value":{"type":["string","null"]}}}},"os_info":{"type":"object","properties":{"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_version":{"type":"string"},"os_release_name":{"type":"string"},"os_type":{"type":"string"}}},"memory":{"type":["object","null"],"properties":{"total_virtual":{"type":"number"},"free_virtual":{"type":"number"},"total_physical":{"type":"number"},"free_physical":{"type":"number"}}},"computer_info":{"type":"object","properties":{"manufacturer":{"type":"string"},"model":{"type":"string"}}},"software_installed":{"type":"array","title":"The startup programs","items":{"type":"object","properties":{"vendor":{"type":"string"},"product":{"type":"string"},"installed_date":{"type":["string","null"]},"version":{"type":"string"}}}},"nics":{"type":"array","title":"The nics","items":{"type":"object","properties":{"mac_address":{"type":"string"},"description":{"type":"string"},"ips":{"type":"array","items":{"type":"string"}}}}},"drives":{"type":["array","null"],"title":"Drives","items":{"type":"object","properties":{"freespace_available":{"type":"number"},"volume_label":{"type":"string"},"drive_format":{"type":"string"},"freespace_total":{"type":"number"},"name":{"type":"string"},"encryption":{"type":"integer"},"total_size":{"type":"number"}}}},"updates_installed":{"type":"array","title":"The startup programs","items":{"type":"object","properties":{"installed_date":{"type":["string","null"]},"title":{"type":"string"}}}},"domain_name":{"type":["string","null"]},"culture":{"type":"string"},"object_sid":{"type":["string","null"]},"dhcp_scope_name":{"type":"string"},"time_zone":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"object_guid":{"type":["string","null"]},"plugin_version":{"type":"string"},"updates_available":{"type":"array","title":"Updates Available","items":{"type":"object","properties":{"category":{"type":"string","examples":["feature_pack"]},"date":{"type":"number","examples":[1640004051]},"description":{"type":"string","examples":["Update Description"]},"kb_id":{"type":"string","examples":["4481252"]},"product":{"type":"string","examples":[".Net Core"]},"reboot_required":{"type":"boolean","examples":[false]},"security_update_id":{"type":"string"},"severity":{"type":"string","examples":["important"]},"size":{"type":"number","examples":[1234465]},"title":{"type":"string","examples":["Security Update for .Net 3.1"]},"vendor":{"type":"string","examples":["Microsoft Corporation"]}}}}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.assets"}},"/api/v2/endpoints/{id}/detections/{detection_id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"detection_id","required":true,"in":"path","description":"The Detection_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Detections By Id Body 200 Schema","type":"object","additionalProperties":true,"required":["id","scan_id","machine_id","detection_id","scanned_at","scanned_at_local","reported_at","status","threat_name","type","path","category","ip_address","url","port","affected_application","md5","process_name"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The Machine_name Schema"},"group_id":{"type":"string","title":"The Group_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_name":{"type":"string","title":"The Group_name Schema"},"policy_id":{"type":"string","title":"The Policy_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"policy_name":{"type":"string","title":"The Policy_name Schema"},"detection_id":{"type":"string","title":"The Detection_id Schema"},"scanned_at":{"type":"string","title":"The Scanned_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"The Scanned_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"The Status Schema"},"action_taken":{"type":"string","title":"The Action Taken Schema","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"threat_name":{"type":"string","title":"The Threat_name Schema"},"type":{"type":"array","title":"The Type Schema","items":{"type":"string","title":"The Items Schema"}},"path":{"type":"string","title":"The Path Schema"},"category":{"type":"string","title":"The Category Schema"},"ip_address":{"type":"string","title":"The Ip_address Schema"},"url":{"type":"string","title":"The Url Schema"},"port":{"type":"string","title":"The Port Schema"},"affected_application":{"type":"string","title":"The Affected_application Schema"},"md5":{"type":"string","title":"The Md5 Schema"},"process_name":{"type":"string","title":"The Process_name Schema"}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.detections.id"}},"/api/v2/endpoints/{id}/detections/{detection_id}/traces":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"detection_id","required":true,"in":"path","description":"The Detection_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Detections By Id Traces Body 200 Schema","type":"object","required":["traces","total_count","next_cursor"],"properties":{"traces":{"type":"array","title":"The Threats Schema","items":{"type":"object","title":"The Items Schema","additionalProperties":true,"required":["id","scan_id","machine_id","machine_name","group_id","detection_id","scanned_at","scanned_at_local","reported_at","status","threat_name","type","path","category","ip_address","url","port","affected_application","md5","process_name"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The Machine_name Schema"},"group_id":{"type":"string","title":"The Group_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The Detection_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scanned_at":{"type":"string","title":"The Scanned_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"The Scanned_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"The Status Schema"},"action_taken":{"type":"string","title":"The Action Taken Schema","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"threat_name":{"type":"string","title":"The Threat_name Schema"},"type":{"type":"array","title":"The Type Schema","items":{"type":"string","title":"The Items Schema"}},"path":{"type":"string","title":"The Path Schema"},"category":{"type":"string","title":"The Category Schema"},"ip_address":{"type":"string","title":"The Ip_address Schema"},"url":{"type":"string","title":"The Url Schema","examples":["https://example.com"]},"port":{"type":"string","title":"The Port Schema"},"affected_application":{"type":"string","title":"The Affected_application Schema"},"md5":{"type":"string","title":"The Md5 Schema"},"process_name":{"type":"string","title":"The Process_name Schema"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.detections.id.traces"}},"/api/v2/endpoints/{id}/detections":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"status","required":false,"in":"query","description":"The Status Schema","schema":{"type":"string","pattern":"^(blocked|found|quarantined|deleted|restored)$"}},{"name":"category","required":false,"in":"query","description":"The Category Schema","schema":{"type":"string","pattern":"^(malware|pup|pum|ae|arw|mwac|rid)$"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","description":"The size of the page","schema":{"type":"string","pattern":"^1?\\d{1,3}$"}},{"name":"start_index","required":false,"in":"query","description":"The index of the first element","schema":{"type":"string","pattern":"\\d+$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Detections Body 200 Schema","type":"object","required":["detections","total_count","next_cursor"],"properties":{"detections":{"type":"array","title":"The Threats Schema","items":{"type":"object","title":"The Items Schema","additionalProperties":true,"required":["id","machine_id","machine_name","group_id","detection_id","scanned_at","scanned_at_local","reported_at","status","type","path","category","ip_address","url","port","affected_application","md5","process_name"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":["string","null"],"title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The Machine_name Schema"},"group_id":{"type":"string","title":"The Group_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The Detection_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scanned_at":{"type":"string","title":"The Scanned_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"The Scanned_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"The Status Schema"},"action_taken":{"type":"string","title":"The Action Taken Schema","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"threat_name":{"type":"string","title":"The Threat_name Schema"},"type":{"type":"array","title":"The Type Schema","items":{"type":"string","title":"The Items Schema"}},"path":{"type":"string","title":"The Path Schema"},"category":{"type":"string","title":"The Category Schema"},"ip_address":{"type":"string","title":"The Ip_address Schema"},"url":{"type":"string","title":"The Url Schema","examples":["https://example.com"]},"port":{"type":"string","title":"The Port Schema"},"affected_application":{"type":"string","title":"The Affected_application Schema"},"md5":{"type":"string","title":"The Md5 Schema"},"process_name":{"type":"string","title":"The Process_name Schema"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.detections"}},"/api/v2/endpoints/{id}/network":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoint By Id Network Body 200 Schema","properties":{"nics":{"type":"array","title":"The Nics Schema","items":{"type":"object","title":"The Items Schema","properties":{"ips":{"type":"array","title":"The Ips Schema","items":{"type":"string","title":"The Items Schema"}},"description":{"type":"string","title":"The Description Schema"},"mac_address":{"type":"string","title":"The Mac_address Schema"}}}},"host_name":{"type":"string","title":"The Host_name Schema"},"fully_qualified_host_name":{"type":"string","title":"The Fully_qualified_host_name Schema"},"last_seen_at":{"type":"string","title":"The Last_seen_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"agent_info_last_updated_at":{"type":"string","title":"The Agent_info_last_updated_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.network"}},"/api/v2/endpoints/{id}/online":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth","caching"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoint By Id Online Status Body 200 Schema","properties":{"online":{"type":"boolean","title":"The Online status Schema"}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.online"}},"/api/v2/endpoints/{id}/quarantine/traces":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$"}},{"name":"category","required":false,"in":"query","description":"The Category Schema","schema":{"type":"string","pattern":"^(malware|pup|pum|arw)$"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Quarantine Traces Body 200 Schema","type":"object","required":["quarantine_traces","total_count","next_cursor"],"properties":{"quarantine_traces":{"type":"array","title":"The Quarantine_traces Schema","items":{"type":"object","title":"The Items Schema","additionalProperties":true,"required":["quarantine_id","scan_id","machine_id","machine_name","group_id","detection_id","scanned_at","scanned_at_local","reported_at","threat_name","type","path","category","ip_address","url","port"],"properties":{"quarantine_id":{"type":"string","title":"The Quarantine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The Machine_name Schema"},"group_id":{"type":"string","title":"The Group_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The Detection_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scanned_at":{"type":"string","title":"The Scanned_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"The Scanned_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"threat_name":{"type":"string","title":"The Threat_name Schema"},"type":{"type":"array","title":"The Type Schema","items":{"type":"string","title":"The Items Schema"}},"path":{"type":"string","title":"The Path Schema"},"category":{"type":"string","title":"The Category Schema"},"ip_address":{"type":"string","title":"The Ip_address Schema"},"url":{"type":"string","title":"The Url Schema","examples":["https://example.com"]},"port":{"type":"string","title":"The Port Schema"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.quarantine-traces"}},"/api/v2/endpoints/{id}/remediation":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.remediation"}},"/api/v2/endpoints/{id}/sa":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"sort_field","required":false,"in":"query","description":"The Sort Schema","schema":{"type":"string","pattern":"^(timestamp|level|pc_hostname)$"}},{"name":"sort_direction","required":false,"in":"query","description":"The Sort Schema","schema":{"type":"string","pattern":"^(asc|desc)$"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"The Next_cursor Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$"}},{"name":"per_page","required":false,"in":"query","description":"The Next_cursor Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoints Body 200 Schema","required":["sa","total_count"],"properties":{"sa":{"type":"array","title":"The sa Schema","items":{"type":"object","title":"The Items Schema","properties":{"detection_id_list":{"type":"array","title":"placeholder","items":{"type":"number"}},"status":{"type":"string","title":"placeholder"},"timestamp":{"type":"string","title":"placeholder"},"path":{"type":"string","title":"placeholder"},"pc_hostname":{"type":"string","title":"placeholder"},"machine_id":{"type":"string","title":"placeholder"},"account_id":{"type":"string","title":"placeholder"},"closed":{"type":"integer","title":"placeholder"},"level":{"type":"integer","title":"placeholder"},"detected_by_count":{"type":"integer","title":"placeholder"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.sa"}},"/api/v2/endpoints/{id}/sa/{sa_id}/exclusions":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"The Detection_id Schema","schema":{"type":"string"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Exclusions for suspicious activity  by endpoint","required":["data"],"properties":{"data":{"type":"array","title":"Exclusions","items":{"type":"object","title":"Exclusion","properties":{"path":{"type":"string","title":"Path"},"md5":{"type":"string","title":"MD5"},"command_line":{"type":"string","title":"command_line"}}}}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.sa.id.exclusion"}},"/api/v2/endpoints/{id}/sa/{sa_id}/remediate":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"The Detection_id Schema","schema":{"type":"string"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The eagle remediate schema","properties":{"job_id":{"type":["string","null"],"title":"ID of the remediation job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.sa.sa_id.remediate"}},"/api/v2/endpoints/{id}/scans/{scan_id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"scan_id","required":true,"in":"path","description":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Scans By Id Body 200 Schema","type":"object","required":["id","machine_id","from_cloud","ondemand","scan_type","started_at","started_at_local","reported_at","duration_seconds","found_count","quarantined_count","deleted_count","total_count","metadata","machine_name","os_platform"],"additionalProperties":false,"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema(Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"schedule_id":{"type":["string","null"],"title":"The schedule_id Schema(Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"schedule_name":{"type":"string","title":"Schedule name (when populated)"},"from_cloud":{"type":"boolean","title":"The From_cloud Schema"},"ondemand":{"type":"boolean","title":"The Ondemand Schema"},"scan_type":{"type":"string","title":"The Scan_type Schema"},"started_at":{"type":"string","title":"The Started_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"started_at_local":{"type":"string","title":"The Started_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"duration_seconds":{"type":"integer","title":"The Duration_seconds Schema"},"found_count":{"type":"integer","title":"The Found_count Schema"},"quarantined_count":{"type":"integer","title":"The Quarantined_count Schema"},"deleted_count":{"type":"integer","title":"The Deleted_count Schema"},"total_count":{"type":"integer","title":"The Total_count Schema"},"metadata":{"type":"object","title":"The Metadata Schema","properties":{"id":{"type":"string","title":"The Id Schema"},"cpu":{"type":"string","title":"The Cpu Schema"},"foldersDetected":{"type":"integer","title":"The Foldersdetected Schema"},"componentsUpdatePackageVersion":{"type":"string","title":"The Componentsupdatepackageversion Schema"},"registryValuesDetected":{"type":"integer","title":"The Registryvaluesdetected Schema"},"schemaVersion":{"type":"integer","title":"The Schemaversion Schema"},"processesDetected":{"type":"integer","title":"The Processesdetected Schema"},"isUserAdmin":{"type":"boolean","title":"The Isuseradmin Schema"},"sourceDetails":{"type":"object","title":"The Sourcedetails Schema","properties":{"scanDurationSecs":{"type":"integer","title":"The Scandurationsecs Schema"},"scanOptions":{"type":"object","title":"The Scanoptions Schema","properties":{"scanMemoryObjects":{"type":"boolean","title":"The Scanmemoryobjects Schema"},"scanStartupAndRegistry":{"type":"boolean","title":"The Scanstartupandregistry Schema"},"scanRootKits":{"type":"boolean","title":"The Scanrootkits Schema"},"scanType":{"type":"string","title":"The Scantype Schema"},"scanPUMs":{"type":"boolean","title":"The Scanpums Schema"},"scanArchives":{"type":"boolean","title":"The Scanarchives Schema"},"scanFileSystem":{"type":"boolean","title":"The Scanfilesystem Schema"},"scanPUPs":{"type":"boolean","title":"The Scanpups Schema"},"useHeuristics":{"type":"boolean","title":"The Useheuristics Schema"}}},"objectsScanned":{"type":"integer","title":"The Objectsscanned Schema"},"scanResult":{"type":"string","title":"The Scanresult Schema"},"type":{"type":"string","title":"The Type Schema"}}},"fileSystem":{"type":"string","title":"The Filesystem Schema"},"dbSDKUpdatePackageVersion":{"type":"string","title":"The Dbsdkupdatepackageversion Schema"},"os":{"type":"string","title":"The Os Schema"},"detectionDateTime":{"type":"string","title":"The Detectiondatetime Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"modulesDetected":{"type":"integer","title":"The Modulesdetected Schema"},"licenseState":{"type":"string","title":"The Licensestate Schema"},"loggedOnUserName":{"type":"string","title":"The Loggedonusername Schema"},"filesDetected":{"type":"integer","title":"The Filesdetected Schema"},"registryKeysDetected":{"type":"integer","title":"The Registrykeysdetected Schema"},"applicationVersion":{"type":"string","title":"The Applicationversion Schema"}}},"machine_name":{"type":"string","title":"The Machine_name Schema"},"os_platform":{"type":"string","title":"The Os_platform Schema"},"devices":{"type":"object","title":"Device control related data"}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.scans.id"}},"/api/v2/endpoints/{id}/scans":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$"}},{"name":"threats_detected","required":false,"in":"query","description":"Optional parameter to filter out scan results based on whether threats were found. If omitted defaults to returning all.","schema":{"type":"string","enum":["true","false",""]}},{"name":"start_index","required":false,"in":"query","description":"The start index for pagination","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","description":"The page size for pagination","schema":{"type":"string"}},{"name":"populate","required":false,"in":"query","schema":{"type":"string","pattern":"^schedules$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Scans Body 200 Schema","type":"array","items":{"type":"object","title":"The Items Schema","required":["id","deleted_count","duration_seconds","found_count","from_cloud","machine_id","machine_name","ondemand","os_platform","quarantined_count","reported_at","scan_type","started_at","started_at_local","total_count"],"additionalProperties":false,"properties":{"id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"deleted_count":{"type":"integer","title":"The Deleted_count Schema"},"duration_seconds":{"type":"integer","title":"The Duration_seconds Schema"},"found_count":{"type":"integer","title":"The Found_count Schema"},"from_cloud":{"type":"boolean","title":"The From_cloud Schema"},"machine_id":{"type":"string","title":"The Machine_id Schema"},"machine_name":{"type":"string","title":"The Machine_name Schema"},"ondemand":{"type":"boolean","title":"The Ondemand Schema"},"os_platform":{"type":"string","title":"The Os_platform Schema"},"quarantined_count":{"type":"integer","title":"The Quarantined_count Schema"},"reported_at":{"type":"string","title":"The Reported_at Schema"},"scan_type":{"type":"string","title":"The Scan_type Schema"},"started_at":{"type":"string","title":"The Started_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"started_at_local":{"type":"string","title":"The Started_at_local Schema"},"total_count":{"type":"integer","title":"The Total_count Schema"},"schedule_id":{"type":"string","title":"The schedule ID. Present only if the scan is triggered by a schedule"},"schedule_name":{"type":"string","title":"The schedule name. Present only if the scan is triggered by a schedule and populate=schedule is sent in the request"},"job_id":{"type":"string","title":"The Job ID. Present only if the scan is triggered by a job"}}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.scans"}},"/api/v2/endpoints/{id}/scans/{scan_id}/detections":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"scan_id","required":true,"in":"path","description":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Scans By Id Detections Body 200 Schema","type":"object","required":["detections","total_count","next_cursor"],"properties":{"detections":{"type":"array","title":"The Threats Schema","items":{"type":"object","title":"The Items Schema","additionalProperties":true,"required":["id","scan_id","machine_id","machine_name","group_id","detection_id","scanned_at","scanned_at_local","reported_at","status","type","path","category","ip_address","url","port","affected_application","md5","process_name"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The Machine_name Schema"},"group_id":{"type":"string","title":"The Group_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The Detection_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scanned_at":{"type":"string","title":"The Scanned_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"The Scanned_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"The Status Schema"},"threat_name":{"type":"string","title":"The Threat_name Schema"},"type":{"type":"array","title":"The Type Schema","items":{"type":"string","title":"The Items Schema"}},"path":{"type":"string","title":"The Path Schema"},"category":{"type":"string","title":"The Category Schema"},"ip_address":{"type":"string","title":"The Ip_address Schema"},"url":{"type":"string","title":"The Url Schema","examples":["https://example.com"]},"port":{"type":"string","title":"The Port Schema"},"affected_application":{"type":"string","title":"The Affected_application Schema"},"md5":{"type":"string","title":"The Md5 Schema"},"process_name":{"type":"string","title":"The Process_name Schema"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.scans.id.detections"}},"/api/v2/endpoints/{id}/status":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoint By Id Status Body 200 Schema","required":["remediation_required","reboot_required","suspicious_activity","isolation","scan_needed"],"properties":{"remediation_required":{"type":"object","title":"The Remediation_required Schema","required":["status","infection_count"],"properties":{"status":{"type":"boolean","title":"The Status Schema"},"infection_count":{"type":"integer"},"job_state":{"type":"integer"}}},"reboot_required":{"type":"object","title":"The Reboot_required Schema","required":["status","reasons"],"properties":{"status":{"type":"boolean","title":"The Status Schema"},"reasons":{"type":"integer","title":"The Reasons Schema"},"job_id":{"type":"string","title":"The Job Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_state":{"title":"The Job_state Schema","type":"integer"}}},"suspicious_activity":{"type":"object","title":"The Suspicious_activity Schema","required":["status","count"],"properties":{"status":{"type":"boolean","title":"The Status Schema"},"count":{"type":"integer","title":"The Count Schema"}}},"isolation":{"type":"object","title":"The Isolation Schema","required":["status","process","network","desktop"],"properties":{"status":{"type":"boolean","title":"The Status Schema"},"process":{"type":"boolean","title":"The Process Schema"},"network":{"type":"boolean","title":"The Network Schema"},"desktop":{"type":"boolean","title":"The Desktop Schema"}}},"scan_needed":{"type":"object","title":"The Scan_needed Schema","required":["status","job_state"],"properties":{"status":{"type":"boolean","title":"The Status Schema"},"job_state":{"type":["null","string"],"title":"The Job_state Schema"},"last_scanned_at":{"type":"string","title":"The Last_scanned_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]}}}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.status"}},"/api/v2/endpoints/{id}/details":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.details.id"}},"/api/v2/endpoints/online":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth","caching"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoint Online Status Body 200 Schema","required":["endpoints"],"properties":{"endpoints":{"type":"array","title":"The Machine_ids Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoint Online Status Body 200 Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.post.endpoint.online"}},"/api/v2/endpoints/{id}/sa/{sa_id}/close":{"put":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"The Detection_id Schema","schema":{"type":"string"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.sa.sa_id.close"}},"/api/v2/endpoints/{id}/sa/{sa_id}/open":{"put":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"The Detection_id Schema","schema":{"type":"string"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.get.endpoint.id.sa.sa_id.open"}},"/api/v2/endpoints/search-groupby":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoints Search GroupBy Request Schema","required":["group_by","page_size"],"allOf":[{"type":"object","title":"PostEndpoints","additionalProperties":true,"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"The Schema"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match)"},"alias":{"type":"string","title":"Aliases for the machine"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"suspicious_activity_found":{"type":"boolean","title":"The Schema"},"reboot_required":{"type":"boolean","title":"The Schema"},"infection_found":{"type":"boolean","title":"The Schema"},"policy_id":{"type":"string","title":"The Schema"},"policy_name":{"type":"string","title":"The Schema"},"policy_etag":{"type":"string","title":"The Schema"},"domain_name":{"type":"string","title":"The Schema"},"engine_version":{"type":"string","title":"The Schema"},"plugins.siem.reboot_reason":{"type":"string","title":"The Schema"},"plugins.siem.plugin_version":{"type":"string","title":"The Schema"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"The Schema"},"plugins.incident_response.reboot_reason":{"type":"string","title":"The Schema"},"plugins.incident_response.plugin_version":{"type":"string","title":"The Schema"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"The Schema"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"The Schema"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"The Schema"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"The Schema"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"The Schema"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"The Schema"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"The Schema"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"The Schema"},"plugins.asset_manager.plugin_version":{"type":"string","title":"The Schema"},"fully_qualified_host_name":{"type":"string","title":"The Schema"},"host_name":{"type":"string","title":"The Schema"},"os_info.os_release_name":{"type":"string","title":"The Schema"},"os_info.os_architecture":{"type":"string","title":"The Schema"},"os_info.os_platform":{"type":"string","title":"The Schema"},"os_info.os_version":{"type":"string","title":"The Schema"},"os_info.os_type":{"type":"string","title":"The Schema"},"nics.description":{"type":"string","title":"The Schema"},"nics.mac_address":{"type":"string","title":"The Schema"},"nics.ips":{"type":"string","title":"The Schema"},"group_name_partial":{"type":"string","title":"The Schema"},"policy_name_partial":{"type":"string","title":"The Schema"},"host_name_partial":{"type":"string","title":"The Schema"},"fully_qualified_host_name_partial":{"type":"string","title":"The Schema"},"engine_version_partial":{"type":"string","title":"The Schema"},"domain_name_partial":{"type":"string","title":"The Schema"},"group_id":{"type":"string","title":"The Schema"},"group_name":{"type":"string","title":"The Schema"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"The populate object Schema","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"default_group":{"type":"boolean","title":"Specify whether the group is default"}}},"page_size":{"type":"number","title":"The page_size Schema","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"subaccounts":{"type":"array","title":"The Subaccounts Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","default":[],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"The Status_filter Schema","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The Next_cursor Schema"},"after":{"type":"string","title":"The after Schema"},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"The page_size Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"Deleted at after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"Deleted at before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan  before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean"}}}],"properties":{"group_by":{"type":"string","title":"The sort field Schema","enum":["os_info.os_platform","os_info.os_type","os_info.os_architecture","os_info.os_version","os_info.os_release_name","engine_version","policy_etag","account_id","group_id","root_group_id","policy_id","machine_ip","last_user","object_guid","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","serial_number","protection_status"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoints Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":["string","object"],"title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"name":{"type":"string","title":"The Total Schema"},"account_name":{"type":"string","title":"The Total Schema"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) endpoints"],"operationId":"api.v2.search.endpoints.group"}},"/api/v2/jobs/{id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Job By Id Body 200 Schema","required":["id","machine_id","machine_name","command","issued_at","issued_by_email","issued_by_name","issued_by","expires_at","updated_at","state"],"additionalProperties":false,"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The Machine_name Schema"},"command":{"type":"string","title":"The Command Schema"},"issued_at":{"type":"string","title":"The Issued_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"issued_by_email":{"type":"string","title":"The Issued_by_email Schema"},"issued_by_name":{"type":"string","title":"The Issued_by_name Schema"},"issued_by":{"type":"string","title":"The Issued_by Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"expires_at":{"type":"string","title":"The Expires_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"updated_at":{"type":"string","title":"The Updated_at Schema"},"state":{"type":"string","title":"The State Schema","pattern":"^PENDING|STARTED|TIMED_OUT|COMPLETED|EXPIRED|FAILED|CANCELLED$","examples":["COMPLETED"]},"cancelled_by":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"cancelled_by_email":{"type":"string","nullable":true,"title":"The email of the user who cancelled the job"},"cancelled_by_name":{"type":"string","nullable":true,"title":"The name of the user who cancelled the job"},"relay_state":{"type":"string","title":"The Relay_state Schema"},"scan_id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["V2 (legacy) jobs"],"operationId":"api.v2.get.jobs.id"}},"/api/v2/jobs/endpoints/isolate":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Isolate Request Body Schema","required":["machine_ids","data"],"properties":{"command":{"type":"string","title":"The Command Schema","default":"command.edr.isolation","pattern":"^(command.edr.isolation)$"},"machine_ids":{"type":"array","title":"The Machine_ids Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"maxItems":100},"relay_state":{"type":"string","title":"The Relay_state Schema"},"data":{"type":"object","title":"The Data Schema","properties":{"desktop":{"type":"boolean","title":"The Command Schema","default":false},"network":{"type":"boolean","title":"The Command Schema","default":false},"process":{"type":"boolean","title":"The Command Schema","default":false}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Job Response 201 Schema","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"The Jobs Schema","items":{"type":"object","title":"The Items Schema","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The Job_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"total_count":{"type":"integer","title":"The Total_count Schema"}}}}}}},"tags":["V2 (legacy) jobs"],"operationId":"api.v2.post.jobs.isolate"}},"/api/v2/jobs/quarantined/traces/remove":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Quarantine Remove Request Body Schema","required":["machine_ids","command","data"],"properties":{"command":{"type":"string","title":"The Command Schema","default":"command.threat.quarantine.remove","pattern":"^(command.threat.quarantine.remove)$"},"machine_ids":{"type":"array","title":"The Machine_ids Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"maxItems":100},"relay_state":{"type":"string","title":"The Relay_state Schema"},"data":{"type":"object","title":"The Data Schema","oneOf":[{"required":["delete_items"],"properties":{"delete_items":{"type":"array","title":"The Delete_items Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1}}},{"required":["delete_all"],"properties":{"delete_all":{"type":"boolean","title":"The Delete_all Schema"}}}]}}}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Job Response 201 Schema","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"The Jobs Schema","items":{"type":"object","title":"The Items Schema","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The Job_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"total_count":{"type":"integer","title":"The Total_count Schema"}}}}}}},"tags":["V2 (legacy) jobs"],"operationId":"api.v2.post.jobs.quarantined.traces.remove"}},"/api/v2/jobs/quarantined/traces/restore":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Quarantine Restore Request Body Schema","required":["machine_ids","command","data"],"properties":{"command":{"type":"string","title":"The Command Schema","default":"command.threat.quarantine.restore","pattern":"^(command.threat.quarantine.restore)$"},"machine_ids":{"type":"array","title":"The Machine_ids Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"maxItems":100},"relay_state":{"type":"string","title":"The Relay_state Schema"},"data":{"type":"object","title":"The Data Schema","oneOf":[{"required":["restore_items"],"properties":{"restore_items":{"type":"array","title":"The Restore_items Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1}}},{"required":["restore_all"],"properties":{"restore_all":{"type":"boolean","title":"The Restore_all Schema"}}}]}}}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Job Response 201 Schema","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"The Jobs Schema","items":{"type":"object","title":"The Items Schema","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The Job_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"total_count":{"type":"integer","title":"The Total_count Schema"}}}}}}},"tags":["V2 (legacy) jobs"],"operationId":"api.v2.post.jobs.quarantined.traces.restore"}},"/api/v2/jobs/endpoints/unlock":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Isolate Request Body Schema","required":["machine_ids"],"properties":{"command":{"type":"string","title":"The Command Schema","default":"command.edr.unlock","pattern":"^(command.edr.unlock)$"},"machine_ids":{"type":"array","title":"The Machine_ids Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"maxItems":100},"relay_state":{"type":"string","title":"The Relay_state Schema"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Job Response 201 Schema","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"The Jobs Schema","items":{"type":"object","title":"The Items Schema","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The Job_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"total_count":{"type":"integer","title":"The Total_count Schema"}}}}}}},"tags":["V2 (legacy) jobs"],"operationId":"api.v2.post.jobs.unlock"}},"/api/v2/jobs":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Job Request Body Schema","required":["machine_ids","command","data"],"properties":{"machine_ids":{"type":"array","title":"The Machine_ids Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"relay_state":{"type":"string","title":"The Relay_state Schema"},"requires_connected":{"type":"boolean","title":"Whether a connection needs to be initiated before issuing this jobs (i.e. active response shell)"},"command":{"type":"string","title":"The Command Schema"},"data":{"type":"object","title":"The Data Schema","properties":{"scan_settings":{"type":"object","title":"The Scan_settings Schema","properties":{"type":{"type":"string","title":"The Type Schema","enum":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":["boolean","string"],"title":"The Remove Schema"}}},"enable_shuriken":{"type":"boolean","title":"The Enable_shuriken Schema"},"allow_postpone_reboot":{"type":"boolean","title":"The Allow_postpone_reboot Schema"},"type":{"type":"string","title":"The Type Schema"},"scan_path_from_list_file":{"type":"boolean","title":"The Scan_path_from_list_file Schema"},"scan_path":{"type":"string","title":"The Scan_path Schema"},"add_scan_paths":{"type":"array","title":"The Add_scan_paths Schema","items":{"type":"string","title":"The Items Schema"}},"no_archive":{"type":"boolean","title":"The No_archive Schema"},"ark":{"type":"boolean","title":"The Ark Schema"},"remove":{"type":"boolean","title":"The Remove Schema"},"no_reboot":{"type":"boolean","title":"The No_reboot Schema"},"reboot_delay":{"type":"integer","title":"The Reboot_delay Schema"},"reboot_delay_rrule":{"type":"string","title":"The Reboot_delay_rrule Schema"},"reboot_message":{"type":"string","title":"The Reboot_message Schema"},"pum_detection":{"type":"string","title":"The Pum_detection Schema"},"pup_detection":{"type":"string","title":"The Pup_detection Schema"},"scan_memory":{"type":"boolean","title":"The Scan_memory Schema"},"scan_registry":{"type":"boolean","title":"The Scan_registry Schema"},"scan_startup":{"type":"boolean","title":"The Scan_startup Schema"},"scan_file_system":{"type":"boolean","title":"The Scan_file_system Schema"},"scan_priority":{"type":"string","title":"The Scan_priority Schema"},"scan_fixed_drives":{"type":"boolean","title":"The Scan_fixed_drives Schema"},"exclusions":{"type":"array","title":"The Exclusions Schema","items":{"type":"object","title":"The Items Schema","additionalProperties":true,"properties":{"value":{"type":"string","title":"The Value Schema"},"type":{"type":"string","title":"The Type Schema"},"exclude_from":{"type":"object","title":"The Exclude_from Schema","properties":{"exploit_protection":{"type":["boolean","null"],"title":"The Exploit_protection Schema"},"malware_protection":{"type":["boolean","null"],"title":"The Malware_protection Schema"},"ransomware_protection":{"type":["boolean","null"],"title":"The Ransomware_protection Schema"},"suspicious_activity":{"type":["boolean","null"],"title":"The Suspicious_activity Schema"},"website_protection":{"type":["boolean","null"],"title":"The Website_protection Schema"}}}}}},"allow_postpone":{"type":["boolean","number"],"title":"Asset Reboot allow postpone"},"delay_in_seconds":{"type":"number","title":"Asset Reboot delay"},"message":{"type":"string","title":"Asset Reboot message"},"reasons":{"type":"number","title":"Asset Reboot reason: 0 RebootStatusClear, 1 RebootStatusDOR, 2 RebootStatusInstall, 3 RebootStatusUpgrade, 4 RebootStatusUnknown"},"restore_items":{"type":"array","title":"Detection IDs to restore from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"delete_items":{"type":"array","title":"Detection IDs to delete from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"patches":{"type":"array","title":"Options for command.asset.patch","items":{"type":"object","properties":{"category":{"type":"string","examples":["feature_pack"]},"product":{"type":"string","examples":["Silverlight"]},"severity":{"type":"string","examples":["critical"]},"title":{"type":"string","examples":["Microsoft Silverlight (KB4481252)"]},"vendor":{"type":"string","examples":["Microsoft Corporation"]}}}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Job Response 201 Schema","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"The Jobs Schema","items":{"type":"object","title":"The Items Schema","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The Job_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"total_count":{"type":"integer","title":"The Total_count Schema"}}}}}}},"tags":["V2 (legacy) jobs"],"operationId":"api.v2.post.jobs"}},"/api/v2/jobs/bulk":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Isolate Request Body Schema","required":["endpoints","groups","command","data"],"properties":{"command":{"type":"string","title":"The Command Schema"},"relay_state":{"type":"string","title":"The Relay_state Schema"},"requires_connected":{"type":"boolean","title":"Whether a connection needs to be initiated before issuing this jobs (i.e. active response shell)"},"data":{"type":"object","title":"The Data Schema","properties":{"scan_settings":{"type":"object","title":"The Scan_settings Schema","properties":{"type":{"type":"string","title":"The Type Schema","enum":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"The Remove Schema"}}},"enable_shuriken":{"type":"boolean","title":"The Enable_shuriken Schema"},"allow_postpone_reboot":{"type":"boolean","title":"The Allow_postpone_reboot Schema"},"type":{"type":"string","title":"The Type Schema"},"scan_path_from_list_file":{"type":"boolean","title":"The Scan_path_from_list_file Schema"},"scan_path":{"type":"string","title":"The Scan_path Schema"},"add_scan_paths":{"type":"array","title":"The Add_scan_paths Schema","items":{"type":"string","title":"The Items Schema"}},"no_archive":{"type":"boolean","title":"The No_archive Schema"},"ark":{"type":"boolean","title":"The Ark Schema"},"remove":{"type":"boolean","title":"The Remove Schema"},"no_reboot":{"type":"boolean","title":"The No_reboot Schema"},"reboot_delay":{"type":"integer","title":"The Reboot_delay Schema"},"reboot_delay_rrule":{"type":"string","title":"The Reboot_delay_rrule Schema"},"reboot_message":{"type":"string","title":"The Reboot_message Schema"},"pum_detection":{"type":"string","title":"The Pum_detection Schema"},"pup_detection":{"type":"string","title":"The Pup_detection Schema"},"scan_memory":{"type":"boolean","title":"The Scan_memory Schema"},"scan_registry":{"type":"boolean","title":"The Scan_registry Schema"},"scan_startup":{"type":"boolean","title":"The Scan_startup Schema"},"scan_file_system":{"type":"boolean","title":"The Scan_file_system Schema"},"scan_priority":{"type":"string","title":"The Scan_priority Schema"},"scan_fixed_drives":{"type":"boolean","title":"The Scan_fixed_drives Schema"},"exclusions":{"type":"array","title":"The Exclusions Schema","items":{"type":"object","title":"The Items Schema","additionalProperties":true,"properties":{"value":{"type":"string","title":"The Value Schema"},"type":{"type":"string","title":"The Type Schema"},"exclude_from":{"type":"object","title":"The Exclude_from Schema","properties":{"exploit_protection":{"type":["boolean","null"],"title":"The Exploit_protection Schema"},"malware_protection":{"type":["boolean","null"],"title":"The Malware_protection Schema"},"ransomware_protection":{"type":["boolean","null"],"title":"The Ransomware_protection Schema"},"suspicious_activity":{"type":["boolean","null"],"title":"The Suspicious_activity Schema"},"website_protection":{"type":["boolean","null"],"title":"The Website_protection Schema"}}}}}},"allow_postpone":{"type":["boolean","number"],"title":"Asset Reboot allow postpone"},"delay_in_seconds":{"type":"number","title":"Asset Reboot delay"},"message":{"type":"string","title":"Asset Reboot message"},"reasons":{"type":"number","title":"Asset Reboot reason: 0 RebootStatusClear, 1 RebootStatusDOR, 2 RebootStatusInstall, 3 RebootStatusUpgrade, 4 RebootStatusUnknown"},"restore_items":{"type":"array","title":"Detection IDs to restore from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"delete_items":{"type":"array","title":"Detection IDs to delete from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"patches":{"type":"array","title":"Options for command.asset.patch","items":{"type":"object","properties":{"category":{"type":"string","examples":["feature_pack"]},"product":{"type":"string","examples":["Silverlight"]},"severity":{"type":"string","examples":["critical"]},"title":{"type":"string","examples":["Microsoft Silverlight (KB4481252)"]},"vendor":{"type":"string","examples":["Microsoft Corporation"]}}}}}},"endpoints":{"type":"array","title":"The Machine_ids Schema","items":{"type":"object","title":"The Items Schema","required":["id","account_id"],"properties":{"id":{"type":"string","title":"machine id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"The Group_ids Schema","items":{"type":"object","title":"Group items","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"machine_id":{"type":"string","title":"Filter the search to the endpoints with specified id"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"alerts.codes":{"type":"string","title":"Alert codes"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search to the endpoints with wildcard EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"default_group":{"type":"boolean","title":"Specify whether the group is default"},"app_block":{"type":"boolean","title":"Specify the number of app block activity"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","object_guid","serial_number"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["1970-01-01T00:00:00Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan  before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"app_block_count_after":{"type":"string","title":"Specify after which date to start app block activity count (Only when populate: {app_block: true} is set) (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}},{"required":["subaccounts"],"additionalProperties":true,"properties":{"subaccounts":{"type":"array","title":"machine id","items":{"type":"string","title":"account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Job Response 201 Schema","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"The Jobs Schema","items":{"type":"object","title":"The Items Schema","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The Job_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}},"total_count":{"type":"integer","title":"The Total_count Schema"}}}}}}},"tags":["V2 (legacy) jobs"],"operationId":"api.v2.post.jobs.bulk"}},"/api/v2/detections/{id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Detection By Id Body 200 Schema","additionalProperties":true,"required":["id","scan_id","machine_id","detection_id","scanned_at","scanned_at_local","reported_at","status","threat_name","type","path","category","ip_address","url","port","affected_application","md5","process_name"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The Machine_name Schema"},"group_id":{"type":"string","title":"The Group_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_name":{"type":"string","title":"The Group_name Schema"},"policy_id":{"type":"string","title":"The Policy_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"policy_name":{"type":"string","title":"The Policy_name Schema"},"detection_id":{"type":"string","title":"The Detection_id Schema"},"scanned_at":{"type":"string","title":"The Scanned_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"The Scanned_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"The Status Schema"},"action_taken":{"type":"string","title":"Action Taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"threat_name":{"type":"string","title":"The Threat_name Schema"},"type":{"type":"array","title":"The Type Schema","items":{"type":"string","title":"The Items Schema"}},"path":{"type":"string","title":"The Path Schema"},"category":{"type":"string","title":"The Category Schema"},"ip_address":{"type":"string","title":"The Ip_address Schema"},"url":{"type":"string","title":"The Url Schema","examples":["https://example.com"]},"port":{"type":"string","title":"The Port Schema"},"affected_application":{"type":"string","title":"The Affected_application Schema"},"md5":{"type":"string","title":"The Md5 Schema"},"sha256":{"type":"string","title":"The Md5 Schema"},"process_name":{"type":"string","title":"The Process_name Schema"}}}}}}},"tags":["V2 (legacy) detections"],"operationId":"api.v2.get.detections.id"}},"/api/v2/detections/search":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"PostDetectionsSearchReqPayload","additionalProperties":true,"properties":{"populate":{"type":"object","title":"The populate object Schema","properties":{"account":{"type":"boolean","title":"Populate with the account data"},"group":{"type":"boolean","title":"Populate with the group data"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (agent, machine_location)"},"scan_result":{"type":"boolean","title":"Populate with the scan_result data"}}},"scan_type":{"type":"string","title":"Type of the scan"},"schedule_id":{"type":"string","title":"ID of the schedule"},"schedule_etag":{"type":"string","title":"ETAG of the schedule"},"job_id":{"type":"string","title":"ID of the job originating this detection"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match)"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name"},"engine_version.keyword":{"type":"string","title":"Filter the search by engine version"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name"},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"machine_name.keyword":{"type":"string","title":"The name of the machine"},"machine_name":{"type":"string","title":"The name of the machine"},"process_name.keyword":{"type":"string","title":"The name of the process that originated this detection"},"process_name":{"type":"string","title":"The name of the process that originated this detection"},"affected_application.keyword":{"type":"string","title":"The application affected by this detection"},"affected_application":{"type":"string","title":"The application affected by this detection"},"category":{"type":"string","title":"The category of this detection"},"not.category":{"type":"string","title":"The category to exclude from search"},"md5":{"type":"string","title":"The md5 hash of this detection"},"path.keyword":{"type":"string","title":"The path where this detection happened"},"path":{"type":"string","title":"The path where this detection happened"},"type":{"type":"string","title":"The type of the detection"},"not.type":{"type":"string","title":"The type to exclude from search"},"threat_name.keyword":{"type":"string","title":"The name of the threat"},"threat_name":{"type":"string","title":"The name of the threat"},"status":{"type":"string","title":"The status of the detection"},"action_taken":{"type":"string","title":"The action taken of the detection","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"correlation_hash":{"type":"string","title":"The hash"},"group_id":{"type":"string","title":"The ID of the group to which the endpoint is assigned (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The ID of the endpoint (machine) where this detection originated (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"parent_detection_id":{"type":"string","title":"The ID of the parent detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The ID of the scan (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"trace_id":{"type":"string","title":"The ID of the parent trace (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"start_date":{"type":"string","title":"Get results after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_after":{"type":"string","title":"Get results generated by a scan happening after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_before":{"type":"string","title":"Get results generated by a scan happening before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_after":{"type":"string","title":"Get results reported after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_before":{"type":"string","title":"Get results reported before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_after":{"type":"string","title":"Get results cleaned after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_before":{"type":"string","title":"Get results cleaned before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"is_root_detection":{"type":"boolean","title":"Whether this detection is the root detection"},"is_rtp_stream_event":{"type":"boolean","title":"Whether this is a Real-Time Protectionevent"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"object_guid":{"type":"string","title":"object_guid filter"},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","sha256","affected_application.keyword","process_name.keyword","machine_name.keyword","scanned_at","reported_at","resource_created_at","resource_modified_at","cleaned_at","is_root_detection","is_rtp_stream_event","object_guid"]},"sort_order":{"type":"string","title":"The order of sorting","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","category_by_status"]}},"subaccounts":{"type":"array","title":"Subaccounts","items":{"type":"string","title":"Subaccounts items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","default":[],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"aggregate_by_account":{"type":"boolean"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"PostDetectionsSearchRes200","properties":{"detections":{"type":"array","title":"The Detections Schema","items":{"type":"object","title":"The Items Schema","additionalProperties":false,"properties":{"id":{"type":"string","title":"The Id Schema"},"account":{"type":"object","title":"The Account Schema","additionalProperties":true},"group":{"type":"object","title":"The Account Schema","additionalProperties":true},"type":{"type":"array","title":"The Type Schema","items":{"type":"string","title":"The Items Schema"}},"status":{"type":"string","title":"The Status Schema"},"path":{"type":"string","title":"The Path Schema"},"group_id":{"type":"string","title":"The Group_id Schema"},"is_root_detection":{"type":"boolean","title":"The Is_root_detection Schema"},"machine_id":{"type":"string","title":"The Machine_id Schema"},"account_id":{"type":"string","title":"The Account_id Schema"},"detection_id":{"type":"string","title":"The Detection_id Schema"},"scanned_at":{"type":"string","title":"The Scanned_at Schema"},"scanned_at_offset_seconds":{"type":"integer","title":"The Scanned_at_offset_seconds Schema"},"reported_at":{"type":"string","title":"The Reported_at Schema"},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"threat_name":{"type":"string","title":"The Threat_name Schema"},"category":{"type":"string","title":"The Category Schema"},"action_taken":{"type":"string","title":"Action Taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"is_rtp_stream_event":{"type":"boolean","title":"The Is_rtp_stream_event Schema"},"process_name":{"type":"string","title":"The Process_name Schema"},"cleaned_at":{"type":"string","title":"The Cleaned_at Schema"},"machine_name":{"type":"string","title":"The Machine_name Schema"},"trace_id":{"type":"string","title":"The Trace_id Schema"},"scan_id":{"type":"string","title":"The Scan_id Schema"},"affected_application":{"type":"string","title":"Affected application"},"md5":{"type":"string","title":"MD5"},"sha256":{"type":"string","title":"SHA256"},"machine_ip":{"type":"string","title":"Machine IP address"},"child_trace_count":{"type":"integer","title":"Child trace count"},"agent":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"at":"2020-10-23T14:20:51.006558Z","is_software_update_available":false,"started_at_local":"2020-10-23T14:20:50.920306Z","started_at_offset":-25200,"nics":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"os_info":{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"},"fully_qualified_host_name":"sahamedw8-1x86","plugins":{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}},"engine_version":"1.2.0.821","policy_etag":"c6ea44914b72c92cba939ac3bd369dc4","last_user":"SAHAMEDW8-1X86\\Administrator","serial_number":"c02thb32g8wn","host_name":"sahamedw8-1x86","machine_id":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","machine_ip":"216.75.233.210"}],"properties":{"at":{"type":"string","title":"The at schema","default":"","examples":["2020-10-23T14:20:51.006558Z"]},"is_software_update_available":{"type":"boolean","title":"The is_software_update_available schema","default":false,"examples":[false]},"started_at_local":{"type":"string","title":"The started_at_local schema","default":"","examples":["2020-10-23T14:20:50.920306Z"]},"started_at_offset":{"type":"integer","title":"The started_at_offset schema","default":0,"examples":[-25200]},"nics":{"type":"array","title":"The nics schema","default":[],"examples":[[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}]],"additionalItems":true,"items":{"anyOf":[{"type":"object","title":"The first anyOf schema","default":{},"examples":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"properties":{"ips":{"type":"array","title":"The ips schema","default":[],"examples":[["10.151.110.52"]],"additionalItems":true,"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["10.151.110.52"]}]}},"description":{"type":"string","title":"The description schema","default":"","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"The mac_address schema","default":"","examples":["005056B91173"]}},"additionalProperties":true}]}},"os_info":{"type":"object","title":"The os_info schema","default":{},"examples":[{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"}],"properties":{"os_type":{"type":"string","title":"The os_type schema","default":"","examples":["Workstation"]},"os_version":{"type":"string","title":"The os_version schema","default":"","examples":["6.3.9600"]},"os_platform":{"type":"string","title":"The os_platform schema","default":"","examples":["Windows"]},"os_architecture":{"type":"string","title":"The os_architecture schema","default":"","examples":["x86"]},"os_release_name":{"type":"string","title":"The os_release_name schema","default":"","examples":["Microsoft Windows 8.1 Pro"]}},"additionalProperties":true},"fully_qualified_host_name":{"type":"string","title":"The fully_qualified_host_name schema","default":"","examples":["sahamedw8-1x86"]},"plugins":{"type":"object","title":"The plugins schema","default":{},"examples":[{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}}],"properties":{"windows_remote_intrusion_detection_and_prevention":{"type":"object","title":"The windows_remote_intrusion_detection_and_prevention schema","default":{},"examples":[{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Windows Remote Intrusion Detection and Prevention"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.21"]}},"additionalProperties":true},"endpoint_protection":{"type":"object","title":"The endpoint_protection schema","default":{},"examples":[{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0}],"properties":{"sdk_version":{"type":"string","title":"The sdk_version schema","default":"","examples":["4.2.1.90"]},"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Protection"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.844"]},"update_package_version":{"type":"string","title":"The update_package_version schema","default":"","examples":["1.0.31870"]},"component_package_version":{"type":"string","title":"The component_package_version schema","default":"","examples":["1.0.1085"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"asset_manager":{"type":"object","title":"The asset_manager schema","default":{},"examples":[{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Asset Manager"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.330"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"endpoint_detection_and_response":{"type":"object","title":"The endpoint_detection_and_response schema","default":{},"examples":[{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Detection and Response"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.297"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true}},"additionalProperties":true},"engine_version":{"type":"string","title":"The engine_version schema","default":"","examples":["1.2.0.821"]},"policy_etag":{"type":"string","title":"The policy_etag schema","default":"","examples":["c6ea44914b72c92cba939ac3bd369dc4"]},"last_user":{"type":"string","title":"The last_user schema","default":"","examples":["SAHAMEDW8-1X86\\Administrator"]},"host_name":{"type":"string","title":"The host_name schema","default":"","examples":["sahamedw8-1x86"]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"machine_ip":{"type":"string","title":"The machine_ip schema","default":"","examples":["216.75.233.210"]},"object_guid":{"type":"string","title":"The object_guid schema","default":""}}},{"title":"Agent information. Included if the request includes populate 'endpoint'"}]},"machine_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Machine location. Included if the request includes populate 'endpoint'"}]},"source_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Source location for RID category"}]},"destination_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Destination location for RID category"}]},"rid_details":{"type":"object","title":"Remote intrusion detection details","properties":{"rule_id":{"type":"string"},"ip":{"type":"string"},"attack_user":{"type":"string"},"protocol":{"type":"string"},"port":{"type":"integer"},"attempts":{"type":"integer"},"duration":{"type":"integer"},"create_time":{"type":"string"},"expire_time":{"type":"string"},"deleted":{"type":"boolean"},"document_id":{"type":"string"},"version":{"type":"integer"}}},"scan_result":{"title":"Scan Result. Included if the request includes populate 'scan_result'","type":"object","properties":{"scan_id":{"type":"string"},"account_id":{"type":"string"},"machine_id":{"type":"string"},"reported_at":{"type":"string"},"scan_type":{"type":"string"},"started_at":{"type":"string"},"started_at_offset_seconds":{"type":"integer"},"duration":{"allOf":[{"bignumber":true},{"type":"number"}]},"found_count":{"type":"integer"},"quarantined_count":{"type":"integer"},"deleted_count":{"type":"integer"},"metadata":{"properties":{"application_version":{"type":"string"},"components_update_package_version":{"type":"string"},"cpu":{"type":"string"},"db_sdk_update_package_version":{"type":"string"},"detection_date_time":{"type":"string"},"file_system":{"type":"string"},"files_detected":{"type":"integer"},"folders_detected":{"type":"integer"},"id":{"type":"string"},"license_state":{"type":"string"},"logged_on_user_name":{"type":"string"},"modules_detected":{"type":"integer"},"os":{"type":"string"},"processes_detected":{"type":"integer"},"registry_data_detected":{"type":"integer"},"registry_keys_detected":{"type":"integer"},"registry_values_detected":{"type":"integer"},"schema_version":{"type":"integer"},"source_details":{"properties":{"objects_scanned":{"type":"integer"},"scan_duration_secs":{"type":"integer"},"scan_options":{"properties":{"pum_handling":{"type":"string"},"pup_handling":{"type":"string"},"scan_archives":{"type":"boolean"},"scan_file_system":{"type":"boolean"},"scan_memory_objects":{"type":"boolean"},"scan_pums":{"type":"boolean"},"scan_pups":{"type":"boolean"},"scan_rootkits":{"type":"boolean"},"scan_startup_and_registry":{"type":"boolean"},"scan_type":{"type":"string"},"use_heuristics":{"type":"boolean"}}},"scan_result":{"type":"string"},"type":{"type":"string"}}},"user_admin":{"type":"boolean"}}},"schedule_id":{"type":"string"},"schedule_etag":{"type":"string"},"job_id":{"type":"string"}}}}}},"aggregations":{"type":"object","additionalProperties":true},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) detections"],"operationId":"api.v2.search.detections"}},"/api/v2/detections/search-groupby":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoints Search GroupBy Request Schema","required":["group_by","page_size"],"additionalProperties":true,"allOf":[{"type":"object","title":"PostDetectionsSearchReqPayload","additionalProperties":true,"properties":{"populate":{"type":"object","title":"The populate object Schema","properties":{"account":{"type":"boolean","title":"Populate with the account data"},"group":{"type":"boolean","title":"Populate with the group data"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (agent, machine_location)"},"scan_result":{"type":"boolean","title":"Populate with the scan_result data"}}},"scan_type":{"type":"string","title":"Type of the scan"},"schedule_id":{"type":"string","title":"ID of the schedule"},"schedule_etag":{"type":"string","title":"ETAG of the schedule"},"job_id":{"type":"string","title":"ID of the job originating this detection"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match)"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name"},"engine_version.keyword":{"type":"string","title":"Filter the search by engine version"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name"},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"machine_name.keyword":{"type":"string","title":"The name of the machine"},"machine_name":{"type":"string","title":"The name of the machine"},"process_name.keyword":{"type":"string","title":"The name of the process that originated this detection"},"process_name":{"type":"string","title":"The name of the process that originated this detection"},"affected_application.keyword":{"type":"string","title":"The application affected by this detection"},"affected_application":{"type":"string","title":"The application affected by this detection"},"category":{"type":"string","title":"The category of this detection"},"not.category":{"type":"string","title":"The category to exclude from search"},"md5":{"type":"string","title":"The md5 hash of this detection"},"path.keyword":{"type":"string","title":"The path where this detection happened"},"path":{"type":"string","title":"The path where this detection happened"},"type":{"type":"string","title":"The type of the detection"},"not.type":{"type":"string","title":"The type to exclude from search"},"threat_name.keyword":{"type":"string","title":"The name of the threat"},"threat_name":{"type":"string","title":"The name of the threat"},"status":{"type":"string","title":"The status of the detection"},"action_taken":{"type":"string","title":"The action taken of the detection","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"correlation_hash":{"type":"string","title":"The hash"},"group_id":{"type":"string","title":"The ID of the group to which the endpoint is assigned (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The ID of the endpoint (machine) where this detection originated (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"parent_detection_id":{"type":"string","title":"The ID of the parent detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The ID of the scan (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"trace_id":{"type":"string","title":"The ID of the parent trace (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"start_date":{"type":"string","title":"Get results after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_after":{"type":"string","title":"Get results generated by a scan happening after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_before":{"type":"string","title":"Get results generated by a scan happening before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_after":{"type":"string","title":"Get results reported after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_before":{"type":"string","title":"Get results reported before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_after":{"type":"string","title":"Get results cleaned after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_before":{"type":"string","title":"Get results cleaned before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"is_root_detection":{"type":"boolean","title":"Whether this detection is the root detection"},"is_rtp_stream_event":{"type":"boolean","title":"Whether this is a Real-Time Protectionevent"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"object_guid":{"type":"string","title":"object_guid filter"},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","sha256","affected_application.keyword","process_name.keyword","machine_name.keyword","scanned_at","reported_at","resource_created_at","resource_modified_at","cleaned_at","is_root_detection","is_rtp_stream_event","object_guid"]},"sort_order":{"type":"string","title":"The order of sorting","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","category_by_status"]}},"subaccounts":{"type":"array","title":"Subaccounts","items":{"type":"string","title":"Subaccounts items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","default":[],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"aggregate_by_account":{"type":"boolean"}}}],"properties":{"group_by":{"type":"string","title":"The sort field Schema","enum":["account_id","group_id","machine_id","type","status","action_taken","category","affected_application.keyword","threat_name.keyword","process_name.keyword","os_info.os_type","os_info.os_platform","object_guid"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000},"subaccounts":{"type":"array","title":"The Subaccounts Schema","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","default":[],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoints Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":"string","title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"name":{"type":"string","title":"The Total Schema"},"tags":{"type":"object","additionalProperties":true,"title":"The Total Schema"},"account_name":{"type":"string","title":"The Total Schema"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) detections"],"operationId":"api.v2.search.detections.group"}},"/api/v2/webhooks/subscriptions":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.createOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Post Schema","required":["url","enabled","events"],"properties":{"url":{"type":"string","title":"The Url Schema (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"The Description Schema"},"enabled":{"type":"boolean","title":"The Enabled Schema"},"events":{"type":"array","title":"The Events Schema","minItems":1,"items":{"type":"string","title":"The Items Schema","enum":["all","detection","job_status_change","machine_events","threat_events","agent_events","quarantine_events","edr_events","syslog_events","exclusion_events","scheduled_events","policy_events","user_events","drive_events","cve_events","dns_events","license_events","appblock_events","endpoint_events"]}},"custom_headers":{"type":"array","title":"The Custom Headers Schema","items":{"type":"object","title":"The Items Schema","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key Schema"},"value":{"type":"string","title":"The header value Schema"}}}},"max_retries":{"type":"integer","title":"The Max_retries Schema","default":10,"exclusiveMinimum":0,"maximum":10},"secret_token":{"type":"string","title":"The Secret_token Schema"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Post Response Schema","required":["id","url","enabled","events"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"The Url Schema (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"The Description Schema"},"enabled":{"type":"boolean","title":"The Enabled Schema"},"events":{"type":"array","title":"The Events Schema","items":{"type":"string","title":"The Items Schema"}},"custom_headers":{"type":"array","title":"The Custom Headers Schema","items":{"type":"object","title":"The Items Schema","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key Schema"},"value":{"type":"string","title":"The header value Schema"}}}},"max_retries":{"type":"integer","title":"The Max_retries Schema","default":10},"secret_token":{"type":"string","title":"The Secret_token Schema"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}}}}},"tags":["V2 (legacy) webhooks"],"operationId":"api.v2.post.webhooks.subscriptions"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["notifications.viewOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Get Schema","required":["records","next_cursor"],"properties":{"records":{"type":"array","title":"The Subscriptions Schema","items":{"type":"object","title":"The Items Schema","required":["id","url","enabled","events"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"The Url Schema (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"The Description Schema"},"enabled":{"type":"boolean","title":"The Enabled Schema"},"events":{"type":"array","title":"The Events Schema","items":{"type":"string","title":"The Items Schema"}},"custom_headers":{"type":"array","title":"The Custom Headers Schema","items":{"type":"object","title":"The Items Schema","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key Schema"},"value":{"type":"string","title":"The header value Schema"}}}},"max_retries":{"type":"integer","title":"The Max_retries Schema"},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) webhooks"],"operationId":"api.v2.post.webhooks.subscriptions.get"}},"/api/v2/webhooks/subscriptions/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.deleteOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"202":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Webhooks Subscriptions Delete Schema","type":"string"}}}}},"tags":["V2 (legacy) webhooks"],"operationId":"api.v2.post.webhooks.subscriptions.delete"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["notifications.viewOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Get Id Schema","required":["id","url","enabled","events"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"The Url Schema (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"The Description Schema"},"enabled":{"type":"boolean","title":"The Enabled Schema"},"events":{"type":"array","title":"The Events Schema","items":{"type":"string","title":"The Items Schema"}},"custom_headers":{"type":"array","title":"The Custom Headers Schema","items":{"type":"object","title":"The Items Schema","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key Schema"},"value":{"type":"string","title":"The header value Schema"}}}},"max_retries":{"type":"integer","title":"The Max_retries Schema","default":10},"secret_token":{"type":"string","title":"The Secret_token Schema"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}}}}},"tags":["V2 (legacy) webhooks"],"operationId":"api.v2.post.webhooks.subscriptions.get.id"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.editOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Post Request Schema","required":["url","enabled","events"],"properties":{"url":{"type":"string","title":"The Url Schema (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"The Description Schema"},"enabled":{"type":"boolean","title":"The Enabled Schema"},"events":{"type":"array","title":"The Events Schema","items":{"type":"string","title":"The Items Schema","enum":["all","detection","job_status_change","machine_events","threat_events","agent_events","quarantine_events","edr_events","syslog_events","exclusion_events","scheduled_events","policy_events","user_events","drive_events","cve_events","dns_events","license_events","appblock_events","endpoint_events"]}},"custom_headers":{"type":"array","title":"The Custom Headers Schema","items":{"type":"object","title":"The Items Schema","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key Schema"},"value":{"type":"string","title":"The header value Schema"}}}},"max_retries":{"type":"integer","title":"The Max_retries Schema","default":10},"secret_token":{"type":"string","title":"The Secret_token Schema"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Put Response Schema","properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"The Url Schema (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"The Description Schema"},"enabled":{"type":"boolean","title":"The Enabled Schema"},"events":{"type":"array","title":"The Events Schema","items":{"type":"string","title":"The Items Schema"}},"custom_headers":{"type":"array","title":"The Custom Headers Schema","items":{"type":"object","title":"The Items Schema","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key Schema"},"value":{"type":"string","title":"The header value Schema"}}}},"max_retries":{"type":"integer","title":"The Max_retries Schema","default":10},"secret_token":{"type":"string","title":"The Secret_token Schema"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}}}}},"tags":["V2 (legacy) webhooks"],"operationId":"api.v2.post.webhooks.subscriptions.update"}},"/api/v2/sa":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}},{"name":"sort_field","required":false,"in":"query","description":"The Sort Schema","schema":{"type":"string","pattern":"^(timestamp|level|pc_hostname)$"}},{"name":"sort_direction","required":false,"in":"query","description":"The Sort Schema","schema":{"type":"string","pattern":"^(asc|desc)$"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"The Next_cursor Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$"}},{"name":"group_ids","required":false,"in":"query","description":"Group ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":["string","array"],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"per_page","required":false,"in":"query","description":"The Next_cursor Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoints Body 200 Schema","required":["sa","total_count"],"properties":{"sa":{"type":"array","title":"The sa Schema","items":{"additionalProperties":true,"type":"object","title":"The Items Schema","properties":{"detection_id_list":{"type":"array","title":"placeholder","items":{"type":"number"}},"status":{"type":"string","title":"placeholder"},"timestamp":{"type":"string","title":"placeholder"},"path":{"type":"string","title":"placeholder"},"pc_hostname":{"type":"string","title":"placeholder"},"machine_id":{"type":"string","title":"placeholder"},"account_id":{"type":"string","title":"placeholder"},"closed":{"type":"integer","title":"placeholder"},"level":{"type":"integer","title":"placeholder"},"detected_by_count":{"type":"integer","title":"placeholder"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) sa"],"operationId":"api.v2.get.suspiciousactivity"}},"/api/v2/sa/{id}/process_graph":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID of suspicious activity","schema":{"type":"string"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Process graph of suspicious activity","additionalProperties":true,"properties":{"data":{"type":"object","title":"Data","additionalProperties":true,"properties":{"node_type":{"type":"string","title":"Node type"},"children":{"type":"array","title":"Children of this node","default":[],"additionalItems":true,"items":{"type":"object","title":"Items of childres","additionalProperties":true,"properties":{"id":{"type":"string","title":"ID"},"name":{"type":"string","title":"Name","examples":["EXPLORER.EXE"]},"node_type":{"type":"string","title":"Node type","examples":["Process"]},"children":{"type":"array","title":"Children of this node. Follows the same structure as current node.","additionalItems":true,"items":{"type":"object","title":"Children items","additionalProperties":true}},"node_info":{"type":"object","title":"Node info","additionalProperties":true,"properties":{"activities":{"type":"array","title":"Activities","default":[],"items":{"type":"object","title":"Activities items","additionalProperties":true},"additionalItems":true},"process_id":{"type":"integer","title":"Process id - PID","examples":[5696]},"dropped":{"type":"boolean","title":"Dropped"},"process_path":{"type":"string","title":"Process path","examples":["C:\\WINDOWS\\EXPLORER.EXE"]}}}}}},"name":{"type":"string","title":"Name","examples":["START"]},"id":{"type":"string","title":"ID","examples":["-"]}}}}}}}}},"tags":["V2 (legacy) sa"],"operationId":"api.v2.get.suspiciousactivity.process_graph"}},"/api/v2/sa/details":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Suspicious activity request payload","required":["detection_id_list","endpoint"],"properties":{"detection_id_list":{"type":"array","title":"List of Suspicious Activity IDs","items":{"type":"integer","title":"Suspicious Activity IDs","examples":[274304,7874825]}},"endpoint":{"type":"string","title":"UUID of the endpoint","examples":["3fdbe4c1-8a80-4a57-8369-9ec4399fbf0b"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Details of suspicious activities","additionalProperties":true,"properties":{"data":{"type":"object","title":"The Details Schema","additionalProperties":true,"properties":{"resolved":{"type":["null","string","number"],"title":"The Resolved Schema"},"pc_hostname":{"type":"string","title":"Hostname of PC"},"status":{"type":"string","title":"Status"},"tot":{"type":"integer","title":"Count of suspicious activities"},"list":{"type":"array","title":"List of suspicious activities","additionalItems":true,"items":{"type":"object","title":"List items","additionalProperties":true,"properties":{"status":{"type":"string","title":"Status","examples":["detected"]},"timestamp":{"type":"string","title":"Timestamp"},"path":{"type":"string","title":"Path","examples":["C:\\WINDOWS\\SYSTEM32\\CMD.EXE"]},"detection_id":{"type":"integer","title":"Id of the suspicious activity"},"details":{"type":"array","title":"Collection of details about suspicious activity","additionalItems":true,"items":{"type":"object","title":"Detail items","additionalProperties":true,"properties":{"timestamp":{"type":"string","title":"Timestamp","examples":["2020-03-25 14:56:12"]},"path":{"type":"string","title":"Path","examples":["C:\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE"]},"detected_by":{"type":"array","title":"Detected by collection","additionalItems":true,"items":{"type":"object","title":"Detected by items","additionalProperties":true,"properties":{"description":{"type":"string","title":"Description","examples":["A suspicious script has been executed by Powershell"]},"verbose":{"type":"string","title":"Verbose Description","examples":["A suspicious script has been executed by Powershell"]},"tag":{"type":"string","title":"Tag","examples":["powershell scripting activity"]},"content":{"type":"array","title":"The Content Schema","default":[],"examples":[[{"launched_proc":"POWERSHELL.EXE","hash":{"Sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","Sha1":"36c5d12033b2eaf251bae61c00690ffb17fddc87","Md5":"cda48fc75952ad12d99e526d0b6bf70a","Sha512":"31946a5c80088646fe951081e88a7478b804da874236a44e845842404c9770450c9b1ac3bb1af2b00b0102fe4983b5728fe4df8c40d28f9bef16230a28ae5df0"},"command_line":"\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -windowstyle hidden -File \"C:\\Program Files\\EAWindowsTool\\EAWindowsTool.ps1 "}]],"additionalItems":true,"items":{"type":"object","title":"The Items Schema","additionalProperties":true,"properties":{"command_line":{"type":"string","title":"Command line","examples":["\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -windowstyle hidden -File \"C:\\Program Files\\EAWindowsTool\\EAWindowsTool.ps1 "]},"hash":{"type":"object","title":"Hashes","additionalProperties":true,"properties":{"Md5":{"type":"string","title":"Md5"},"Sha1":{"type":"string","title":"Sha1","examples":["36c5d12033b2eaf251bae61c00690ffb17fddc87"]},"Sha256":{"type":"string","title":"Sha256","examples":["908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53"]},"Sha512":{"type":"string","title":"Sha512","examples":["31946a5c80088646fe951081e88a7478b804da874236a44e845842404c9770450c9b1ac3bb1af2b00b0102fe4983b5728fe4df8c40d28f9bef16230a28ae5df0"]}}},"launched_proc":{"type":"string","title":"Launched process","examples":["POWERSHELL.EXE"]}}}},"level":{"type":"integer","title":"Level"}}}},"pid":{"type":"integer","title":"Process ID"}}}},"pid":{"type":"integer","title":"Process ID"}}}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) sa"],"operationId":"api.v2.get.suspiciousactivity.details"}},"/api/v2/scans/{id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Scan By Id Body 200 Schema","required":["id","machine_id","from_cloud","ondemand","scan_type","started_at","started_at_local","reported_at","duration_seconds","found_count","quarantined_count","deleted_count","total_count","metadata","machine_name","os_platform"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"from_cloud":{"type":"boolean","title":"The From_cloud Schema"},"ondemand":{"type":"boolean","title":"The Ondemand Schema"},"scan_type":{"type":"string","title":"The Scan_type Schema"},"started_at":{"type":"string","title":"The Started_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"started_at_local":{"type":"string","title":"The Started_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"duration_seconds":{"type":"integer","title":"The Duration_seconds Schema"},"found_count":{"type":"integer","title":"The Found_count Schema"},"quarantined_count":{"type":"integer","title":"The Quarantined_count Schema"},"deleted_count":{"type":"integer","title":"The Deleted_count Schema"},"total_count":{"type":"integer","title":"The Total_count Schema"},"metadata":{"type":"object","title":"The Metadata Schema","properties":{"id":{"type":"string","title":"The Id Schema"},"cpu":{"type":"string","title":"The Cpu Schema"},"foldersDetected":{"type":"integer","title":"The Foldersdetected Schema"},"componentsUpdatePackageVersion":{"type":"string","title":"The Componentsupdatepackageversion Schema"},"registryValuesDetected":{"type":"integer","title":"The Registryvaluesdetected Schema"},"schemaVersion":{"type":"integer","title":"The Schemaversion Schema"},"processesDetected":{"type":"integer","title":"The Processesdetected Schema"},"isUserAdmin":{"type":"boolean","title":"The Isuseradmin Schema"},"sourceDetails":{"type":"object","title":"The Sourcedetails Schema","properties":{"scanDurationSecs":{"type":"integer","title":"The Scandurationsecs Schema"},"scanOptions":{"type":"object","title":"The Scanoptions Schema","properties":{"scanMemoryObjects":{"type":"boolean","title":"The Scanmemoryobjects Schema"},"scanStartupAndRegistry":{"type":"boolean","title":"The Scanstartupandregistry Schema"},"scanRootKits":{"type":"boolean","title":"The Scanrootkits Schema"},"scanType":{"type":"string","title":"The Scantype Schema"},"scanPUMs":{"type":"boolean","title":"The Scanpums Schema"},"scanArchives":{"type":"boolean","title":"The Scanarchives Schema"},"scanFileSystem":{"type":"boolean","title":"The Scanfilesystem Schema"},"scanPUPs":{"type":"boolean","title":"The Scanpups Schema"},"useHeuristics":{"type":"boolean","title":"The Useheuristics Schema"}}},"objectsScanned":{"type":"integer","title":"The Objectsscanned Schema"},"scanResult":{"type":"string","title":"The Scanresult Schema"},"type":{"type":"string","title":"The Type Schema"}}},"fileSystem":{"type":"string","title":"The Filesystem Schema"},"dbSDKUpdatePackageVersion":{"type":"string","title":"The Dbsdkupdatepackageversion Schema"},"os":{"type":"string","title":"The Os Schema"},"detectionDateTime":{"type":"string","title":"The Detectiondatetime Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"modulesDetected":{"type":"integer","title":"The Modulesdetected Schema"},"licenseState":{"type":"string","title":"The Licensestate Schema"},"loggedOnUserName":{"type":"string","title":"The Loggedonusername Schema"},"filesDetected":{"type":"integer","title":"The Filesdetected Schema"},"registryKeysDetected":{"type":"integer","title":"The Registrykeysdetected Schema"},"applicationVersion":{"type":"string","title":"The Applicationversion Schema"}}},"machine_name":{"type":"string","title":"The Machine_name Schema"},"os_platform":{"type":"string","title":"The Os_platform Schema"}}}}}}},"tags":["V2 (legacy) scans"],"operationId":"api.v2.get.scans.id"}},"/api/v2/applications/client/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","oauth2"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) applications"],"operationId":"api.oauth2.put.applications"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["integrations.view"]}],"status":{"outage":["auth","oauth2"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) applications"],"operationId":"api.oauth2.get.application"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","oauth2"]},"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"putClient","required":[],"additionalProperties":true,"properties":{"client_name":{"type":"string","title":"The name of this application"},"license_key":{"type":"string","title":"License key to bind to this client"},"grant_types":{"type":"array","title":"The grant types","items":{"type":"string","title":"The grant type","enum":["client_credentials","authorization_code","refresh_token"]}},"audience":{"type":"string","title":"The audience for this pair of credentials"},"scopes":{"type":"array","title":"The name of this application","items":{"type":"string","title":"The Scope","pattern":"^(read|write|execute|create:accounts|openid|offline)$"}},"redirect_uris":{"type":"array","title":"The valid redirect URIs of this application","items":{"type":"string","title":"The URI (Ex. \"https://example.com\")","pattern":"^(http|https)://.{4,}$","examples":["https://example.com"]}},"allowed_cors_origins":{"type":"array","title":"The valid CORS origins for this application","items":{"type":"string","title":"The origin URL (Ex. \"https://example.com\")","pattern":"^(http|https)://.{4,}$","examples":["https://example.com"]}},"regenerateClientSecret":{"type":"boolean","title":"If true a new client secret is generated"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) applications"],"operationId":"api.oauth2.put.applications"}},"/api/v2/applications/clients":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["integrations.view"]}],"status":{"outage":["auth","oauth2"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) applications"],"operationId":"api.oauth2.get.applications"}},"/api/v2/applications/consent":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["integrations.view"]}],"status":{"outage":["auth","oauth2"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) applications"],"operationId":"api.oauth2.get.applications.consent"},"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","oauth2"]},"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"deleteConsent","required":["client_id"],"properties":{"client_id":{"type":"string","title":"The client Id"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) applications"],"operationId":"api.oauth2.delete.applications.consent"}},"/api/v2/applications/client":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","oauth2"]},"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"postClient","required":["client_name","scopes"],"additionalProperties":true,"properties":{"client_name":{"type":"string","title":"The name of this application"},"license_key":{"type":"string","title":"License key to bind to this client"},"grant_types":{"type":"array","title":"The grant types","items":{"type":"string","title":"The grant type","enum":["client_credentials","authorization_code","refresh_token"]},"default":["client_credentials"]},"audience":{"type":"string","title":"The audience for this pair of credentials"},"scopes":{"type":"array","title":"The name of this application","default":[],"items":{"type":"string","title":"The Scope","pattern":"^(read|write|execute|create:accounts|openid|offline|create-accounts)$"}},"redirect_uris":{"type":"array","title":"The valid redirect URIs of this application","items":{"type":"string","title":"The URI (Ex. \"https://example.com\")","default":[],"pattern":"^(http|https)://.{4,}$","examples":["https://example.com"]}},"allowed_cors_origins":{"type":"array","title":"The valid CORS origins for this application","items":{"type":"string","title":"The origin URL  (Ex. \"https://example.com\")","default":[],"pattern":"^(http|https)://.{4,}$","examples":["https://example.com"]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) applications"],"operationId":"api.oauth2.post.applications"}},"/api/v2/accounts/{account_id}/applications/client":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","oauth2"]},"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"postClient","required":["client_name","scopes"],"additionalProperties":true,"properties":{"client_name":{"type":"string","title":"The name of this application"},"grant_types":{"type":"array","title":"The grant types","items":{"type":"string","title":"The grant type","enum":["client_credentials","authorization_code","refresh_token"]},"default":["client_credentials"]},"scopes":{"type":"array","title":"The name of this application","default":[],"items":{"type":"string","title":"The Scope","pattern":"^(read|write|execute|openid|offline)$"}},"redirect_uris":{"type":"array","title":"The valid redirect URIs of this application","items":{"type":"string","title":"The URI (Ex. \"https://example.com\")","default":[],"pattern":"^(http|https)://.{4,}$","examples":["https://example.com"]}},"allowed_cors_origins":{"type":"array","title":"The valid CORS origins for this application","items":{"type":"string","title":"The origin URL (Ex. \"https://example.com\")","default":[],"pattern":"^(http|https)://.{4,}$","examples":["https://example.com"]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) applications"],"operationId":"api.oauth2.post.applications"}},"/api/v2/policies/{account_id}/{id}":{"delete":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.delete"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.delete.policy"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"populate","required":false,"in":"query","schema":{"type":"string","pattern":"^(groups|exclusions)([,](groups|exclusions))*$"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.get.policy.id"},"put":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.put.policy"}},"/api/v2/policies/{account_id}/{id}/isolation_image":{"delete":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.delete.policy.id"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.get.policy.id"},"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.get.policy.id"}},"/api/v2/policies/{account_id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.get.policy"},"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.create"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.post.policy"}},"/api/v2/policies/{account_id}/system_default":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.get.policy.system_default"}},"/api/v2/policies/{account_id}/{source_id}/clone":{"post":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["policies.create"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.post.policy.clone"}},"/api/v2/policies/{account_id}/{id}/promote":{"put":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) policies"],"operationId":"api.v2.put.policy.promote"}},"/api/v2/exclusions/{account_id}/{id}":{"delete":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) exclusions"],"operationId":"api.v2.delete.exclusions"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"populate_risk","required":false,"in":"query","description":"Populate risk fields on exclusion","schema":{"type":"boolean"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) exclusions"],"operationId":"api.v2.get.exclusions.id"},"put":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) exclusions"],"operationId":"api.v2.put.policy"}},"/api/v2/exclusions/{account_id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"search_string","required":false,"in":"query","description":"Search with exclusion string.","schema":{"type":"string"}},{"name":"policy_ids","required":false,"in":"query","description":"Search with exclusion policy ids.","schema":{"type":"string"}},{"name":"type","required":false,"in":"query","description":"Search with exclusion type","schema":{"type":"number"}},{"name":"since","required":false,"in":"query","description":"Timestamp to filter since exclusion times.","schema":{"type":"string"}},{"name":"until","required":false,"in":"query","description":"Timestamp to filter until exclusion times.","schema":{"type":"string"}},{"name":"sort_by","required":false,"in":"query","description":"Field to sort results with.","schema":{"type":"string","enum":["enabled","value","created_at","updated_at","created_by","updated_by","type"]}},{"name":"sort_order","required":false,"in":"query","description":"Sorting direction","schema":{"type":"string","enum":["asc","desc"]}},{"name":"populate_risk","required":false,"in":"query","description":"Populate risk fields on exclusions","schema":{"type":"boolean"}},{"name":"risk","required":false,"in":"query","description":"Filter exclusions by risk level (validated by Retina)","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) exclusions"],"operationId":"api.v2.get.exclusions"},"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.create"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) exclusions"],"operationId":"api.v2.post.policy"}},"/api/v2/exclusions/{account_id}/bulk":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["exclusions.create"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) exclusions"],"operationId":"api.v2.post.exclusion.bulk"}},"/api/v2/accounts":{"post":{"security":[{"oauth_ac":["create:accounts"]},{"client_credentials":["create:accounts"]},{"nebula":[]},{"user_permissions":["account.manage","sites.create"]}],"status":{"outage":["auth"]},"requestBody":{"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) accounts"],"operationId":"api.oauth2.post.accounts"}},"/api/v2/accounts/parent":{"post":{"security":[{"oauth_ac":["create:accounts"]},{"client_credentials":["create:accounts"]},{"nebula":[]},{"user_permissions":["account.manage"]}],"status":{"outage":["auth"]},"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","properties":{"name":{"type":"string","description":"Display name for account"},"owner_user_name":{"type":"string","description":"Owner User's display name"},"owner_user_email":{"type":"string","format":"email","description":"Owner User's email address"},"owner_user_password":{"type":"string","description":"Owner User's password"},"license_key":{"type":"string","description":"Account's License Key"},"parent_account_id":{"type":"string","format":"uuid","description":"Parent Account ID"},"default_policy_id":{"type":"string","format":"uuid","description":"Default Policy ID desired for account"},"disable_owner_invite":{"type":"boolean","description":"Disable Owner Invite"},"options":{"description":"Account Registration Options","type":"object","properties":{"type":{"type":"string","description":"The type of account creation option","enum":["oneview"]}},"required":["type"]}},"required":["name","owner_user_name","owner_user_email","license_key"]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) accounts"],"operationId":"api.oauth2.post.accounts.parent"}},"/api/v2/accounts/link":{"post":{"security":[{"oauth_ac":["admin"]},{"client_credentials":["admin"]},{"nebula":[]},{"user_permissions":["account.manage"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) accounts"],"operationId":"api.oauth2.post.accounts.link"},"delete":{"security":[{"oauth_ac":["admin"]},{"client_credentials":["admin"]},{"nebula":[]},{"user_permissions":["account.manage"]}],"status":{"outage":["auth"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) accounts"],"operationId":"api.oauth2.post.accounts.link"}},"/api/v2/logo/{filename}":{"get":{"status":{"outage":["ov"]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) accounts"],"operationId":"api.v2.accounts.logo"}},"/api/v2/accounts/migrate":{"post":{"security":[{"oauth_ac":["create:accounts"]},{"client_credentials":["create:accounts"]},{"nebula":[]},{"user_permissions":["account.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","title":"Verification code","description":"Response schema","examples":[{"email":"admin@company.ee","ttl":"60","msp_id":"123456"}],"type":"object","required":["email","msp_id","from","subject","template_params"],"properties":{"msp_id":{"type":"string","title":"Id of the MSP","description":"id of the to be used to send verification code."},"from":{"type":"string","title":"from email","description":"from email"},"from_name":{"type":"string","title":"From email name","description":"The name to show on inboxes instead of mail","default":"ThreatDown"},"subject":{"type":"string","title":"subject of the email","description":"subject of the email"},"template_params":{"type":"object","title":"Template params to be used for seeding the template. 'verification_code' and 'ttl_minute' are reserved","description":"emplate params to be used for seeding the template. 'verification_code' and 'ttl_minute' are reserved"},"email":{"type":"string","title":"Email to verify","description":"Email to verify.","examples":["admin@company.ee"]},"ttl":{"type":"number","title":"Time to live for this code, in seconds","description":"TTL in seconds","examples":[60]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Generate Verification code","description":"Response schema","examples":[{"expires_in":60,"msp_id":"123456"}],"required":["expires_in"],"properties":{"expires_in":{"type":"number","title":"Time to live for this code, in seconds","description":"TTL in seconds","examples":[60]},"msp_id":{"type":"string","title":"transaction id","description":"transaction id useful for correlation","examples":["90795468-5a24-4eb4-84a3-5cc9365104f1"]},"key":{"type":"string","title":"transaction id","description":"transaction id useful for correlation","examples":["90795468-5a24-4eb4-84a3-5cc9365104f1"]}}}}}}},"tags":["V2 (legacy) accounts"],"operationId":"api.ov.post.migrate"}},"/api/v2/accounts/migrate/consent":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["account.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"accountid","required":true,"in":"header","description":"Your Nebula account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Generate Verification code","description":"Response schema","examples":[{"code":"134251241523","transaction_id":"123456","accept":false}],"required":["code","msp_id","accept"],"properties":{"accept":{"type":"boolean","title":"Whether the request is accepted or rejected","description":"Validity","examples":[false]},"elegibility":{"type":"boolean","title":"Only check elegibility","description":"Validity","examples":[false]},"code":{"type":"string","title":"Secret code for confirmation","description":"Secret code for confirmation","examples":["134251241523"]},"msp_id":{"type":"string","title":"transaction id","description":"transaction id useful for correlation","examples":["90795468-5a24-4eb4-84a3-5cc9365104f1"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Verification code","description":"Response schema","examples":[{"valid":true}],"required":["valid"],"properties":{"valid":{"type":"boolean","title":"Validity of the request","description":"Validity","enum":[true],"examples":[true]}}}}}}},"tags":["V2 (legacy) accounts"],"operationId":"api.admin.post.migrate.consent"}},"/api/v2/events/mappings":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["subscriptions_db"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"x-mwb-tenant","required":false,"in":"header","description":"The tenant Id. It can be omitted if the auth token is authorized only for 1 specific tenant resource","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The create mapping Body","properties":{"id":{"type":"string","title":"The mapping Id. If omitted or empty string, the default mapping will be used","pattern":"[a-z0-9\\-_+\\.]*"},"map_unmapped":{"title":"If true, unmapped fields are mapped as strings","type":"boolean","default":true},"fields":{"title":"The fields mapping","type":"object","additionalProperties":{"title":"A field mapping","type":"object","required":["type"],"properties":{"type":{"title":"the type of the field","type":"string","enum":["binary","boolean","keyword","long","integer","short","byte","double","float","half_float","scaled_float","unsigned_long","date","object","flattened","nested","join","integer_range","float_range","long_range","double_range","date_range","ip_range","ip","text","geo_point","geo_shape","point","shape"]}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) events"],"operationId":"api.v2.post.events.mappings"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["subscriptions_db"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"x-mwb-tenant","required":false,"in":"header","description":"The tenant Id. It can be omitted if the auth token is authorized only for 1 specific tenant resource","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get events mappings Body 200 Schema","required":["mappings"],"properties":{"mappings":{"type":"array","title":"The events mappings list","items":{"type":"string","title":"The mapping Id. If omitted or empty string, the default mapping will be used","pattern":"[a-z0-9\\-_+\\.]*"}}}}}}}},"tags":["V2 (legacy) events"],"operationId":"api.v2.get.all.events.mappings"}},"/api/v2/events/mappings/{id}":{"delete":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["subscriptions_db"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID of the resource","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"x-mwb-tenant","required":false,"in":"header","description":"The tenant Id. It can be omitted if the auth token is authorized only for 1 specific tenant resource","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) events"],"operationId":"api.v2.delete.events.mappings"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["subscriptions_db"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID of the resource","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"x-mwb-tenant","required":false,"in":"header","description":"The tenant Id. It can be omitted if the auth token is authorized only for 1 specific tenant resource","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get mapping Body 200 Schema","required":["map_unmapped","fields"],"properties":{"id":{"type":"string","title":"The mapping Id. If omitted or empty string, the default mapping will be used","pattern":"[a-z0-9\\-_+\\.]*"},"map_unmapped":{"title":"If true, unmapped fields are mapped as strings","type":"boolean"},"fields":{"title":"The fields mapping","type":"object","additionalProperties":true}}}}}}},"tags":["V2 (legacy) events"],"operationId":"api.v2.get.events.mappings"}},"/api/v2/events":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":[]}],"status":{},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"x-mwb-tenant","required":false,"in":"header","description":"The tenant Id. It can be omitted if the auth token is authorized only for 1 specific tenant resource","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Interface for sending a new event to aggregate","required":["payload"],"properties":{"mapping_id":{"type":"string","title":"The mapping Id. If omitted or empty string, the default mapping will be used","pattern":"[a-z0-9\\-_+\\.]*"},"payload":{"type":"object","title":"The event to send for aggregation","additionalProperties":true},"filter":{"type":"string","title":"A value to filter the subscriptions before percolation, for improving performances."}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) events"],"operationId":"api.v2.post.events.send"}},"/api/v2/events/subscriptions":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["subscriptions_db"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"x-mwb-tenant","required":false,"in":"header","description":"The tenant Id. It can be omitted if the auth token is authorized only for 1 specific tenant resource","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The create subscription Body","required":["id","query","immediate","emit_condition","output_schema","delivery"],"properties":{"id":{"title":"Subscription Id","type":"string"},"description":{"title":"Subscription description","type":"string"},"query":{"title":"Query. Defines which events belongs to this subscriptions. It should be a valid ES query","type":"object","additionalProperties":true},"immediate":{"title":"If true the events are not aggregated and emitted asap one at time","type":"boolean","default":false},"emit_condition":{"title":"Emit condition. Defines when the events belonging to this subscriptions should be emitted","type":"object","anyOf":[{"required":["condition"]},{"required":["time_window"]}],"properties":{"condition":{"title":"Emit condition expressed in JSON logic","type":"string"},"time_window":{"title":"Time window in seconds. After it expires the events will be emitted","type":"number"},"post_condition":{"title":"Emit condition expressed in JSON logic. evaluated after the time_window expires","type":"string"}}},"output_schema":{"title":"Output schema. Defines the scheme of the emitted notification","type":"object","required":["aggregations"],"properties":{"include":{"title":"Whether to include all events in the output, or only aggregations and subscription data","type":"string"},"aggregations":{"title":"Aggregated fields in the output","type":"array","items":{"title":"Aggregation object","type":"object","required":["name","operator"],"oneOf":[{"required":["field"],"properties":{"operator":{"enum":["MAX","MIN","MAP","SET","AVG","SUM","FIRST","LAST","VALUE"]}}},{"properties":{"operator":{"enum":["COUNT"]}}}],"properties":{"name":{"title":"field name in output schema","type":"string"},"field":{"title":"input field from the event","type":"string"},"operator":{"title":"aggregation operator","type":"string"}}}}}},"partition_keys":{"title":"Partition keys. Partition the events based on the values of the specified keys","type":"array","items":{"title":"Partition key","type":"string"}},"delivery":{"title":"Delivery information. Specify the delivery method","type":"object","required":["type"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook","email","slack","teams"]},"url":{"title":"Webhook url","type":"string"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},"filter":{"title":"Filter values for search optimization","type":"array","items":{"type":"string"}},"mapping_id":{"type":"string","title":"The mapping Id. If omitted or empty string, the default mapping will be used","pattern":"[a-z0-9\\-_+\\.]*"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) events"],"operationId":"api.v2.post.events.subscriptions"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["subscriptions_db"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"x-mwb-tenant","required":false,"in":"header","description":"The tenant Id. It can be omitted if the auth token is authorized only for 1 specific tenant resource","schema":{"type":"string"}},{"name":"mapping_id","required":false,"in":"query","description":"The mapping Id. If omitted or empty string, the default mapping will be used","schema":{"type":"string","pattern":"[a-z0-9\\-_+\\.]*"}},{"name":"page_size","required":false,"in":"query","description":"The page_size Schema","schema":{"type":"string","pattern":"^\\d{1,3}$"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get events subscriptions Body 200 Schema","required":["subscriptions","total_count"],"properties":{"subscriptions":{"type":"array","title":"The events subscription Schema","items":{"type":"object","title":"The create subscription Body","required":["id","query","immediate","emit_condition","output_schema","delivery"],"properties":{"id":{"title":"Subscription Id","type":"string"},"description":{"title":"Subscription description","type":"string"},"query":{"title":"Query. Defines which events belongs to this subscriptions. It should be a valid ES query","type":"object","additionalProperties":true},"immediate":{"title":"If true the events are not aggregated and emitted asap one at time","type":"boolean","default":false},"emit_condition":{"title":"Emit condition. Defines when the events belonging to this subscriptions should be emitted","type":"object","anyOf":[{"required":["condition"]},{"required":["time_window"]}],"properties":{"condition":{"title":"Emit condition expressed in JSON logic","type":"string"},"time_window":{"title":"Time window in seconds. After it expires the events will be emitted","type":"number"},"post_condition":{"title":"Emit condition expressed in JSON logic. evaluated after the time_window expires","type":"string"}}},"output_schema":{"title":"Output schema. Defines the scheme of the emitted notification","type":"object","required":["aggregations"],"properties":{"include":{"title":"Whether to include all events in the output, or only aggregations and subscription data","type":"string"},"aggregations":{"title":"Aggregated fields in the output","type":"array","items":{"title":"Aggregation object","type":"object","required":["name","operator"],"oneOf":[{"required":["field"],"properties":{"operator":{"enum":["MAX","MIN","MAP","SET","AVG","SUM","FIRST","LAST","VALUE"]}}},{"properties":{"operator":{"enum":["COUNT"]}}}],"properties":{"name":{"title":"field name in output schema","type":"string"},"field":{"title":"input field from the event","type":"string"},"operator":{"title":"aggregation operator","type":"string"}}}}}},"partition_keys":{"title":"Partition keys. Partition the events based on the values of the specified keys","type":"array","items":{"title":"Partition key","type":"string"}},"delivery":{"title":"Delivery information. Specify the delivery method","type":"object","required":["type"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook","email","slack","teams"]},"url":{"title":"Webhook url","type":"string"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},"filter":{"title":"Filter values for search optimization","type":"array","items":{"type":"string"}},"mapping_id":{"type":"string","title":"The mapping Id. If omitted or empty string, the default mapping will be used","pattern":"[a-z0-9\\-_+\\.]*"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) events"],"operationId":"api.v2.get.all.events.subscriptions"}},"/api/v2/events/subscriptions/{id}":{"delete":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["subscriptions_db"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID of the resource","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"x-mwb-tenant","required":false,"in":"header","description":"The tenant Id. It can be omitted if the auth token is authorized only for 1 specific tenant resource","schema":{"type":"string"}},{"name":"mapping_id","required":false,"in":"query","description":"The mapping Id. If omitted or empty string, the default mapping will be used","schema":{"type":"string","pattern":"[a-z0-9\\-_+\\.]*"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) events"],"operationId":"api.v2.delete.events.subscriptions"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["subscriptions_db"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID of the resource","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"x-mwb-tenant","required":false,"in":"header","description":"The tenant Id. It can be omitted if the auth token is authorized only for 1 specific tenant resource","schema":{"type":"string"}},{"name":"mapping_id","required":false,"in":"query","description":"The mapping Id. If omitted or empty string, the default mapping will be used","schema":{"type":"string","pattern":"[a-z0-9\\-_+\\.]*"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The create subscription Body","required":["id","query","immediate","emit_condition","output_schema","delivery"],"properties":{"id":{"title":"Subscription Id","type":"string"},"description":{"title":"Subscription description","type":"string"},"query":{"title":"Query. Defines which events belongs to this subscriptions. It should be a valid ES query","type":"object","additionalProperties":true},"immediate":{"title":"If true the events are not aggregated and emitted asap one at time","type":"boolean","default":false},"emit_condition":{"title":"Emit condition. Defines when the events belonging to this subscriptions should be emitted","type":"object","anyOf":[{"required":["condition"]},{"required":["time_window"]}],"properties":{"condition":{"title":"Emit condition expressed in JSON logic","type":"string"},"time_window":{"title":"Time window in seconds. After it expires the events will be emitted","type":"number"},"post_condition":{"title":"Emit condition expressed in JSON logic. evaluated after the time_window expires","type":"string"}}},"output_schema":{"title":"Output schema. Defines the scheme of the emitted notification","type":"object","required":["aggregations"],"properties":{"include":{"title":"Whether to include all events in the output, or only aggregations and subscription data","type":"string"},"aggregations":{"title":"Aggregated fields in the output","type":"array","items":{"title":"Aggregation object","type":"object","required":["name","operator"],"oneOf":[{"required":["field"],"properties":{"operator":{"enum":["MAX","MIN","MAP","SET","AVG","SUM","FIRST","LAST","VALUE"]}}},{"properties":{"operator":{"enum":["COUNT"]}}}],"properties":{"name":{"title":"field name in output schema","type":"string"},"field":{"title":"input field from the event","type":"string"},"operator":{"title":"aggregation operator","type":"string"}}}}}},"partition_keys":{"title":"Partition keys. Partition the events based on the values of the specified keys","type":"array","items":{"title":"Partition key","type":"string"}},"delivery":{"title":"Delivery information. Specify the delivery method","type":"object","required":["type"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook","email","slack","teams"]},"url":{"title":"Webhook url","type":"string"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},"filter":{"title":"Filter values for search optimization","type":"array","items":{"type":"string"}},"mapping_id":{"type":"string","title":"The mapping Id. If omitted or empty string, the default mapping will be used","pattern":"[a-z0-9\\-_+\\.]*"}}}}}}},"tags":["V2 (legacy) events"],"operationId":"api.v2.get.events.subscriptions"},"put":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":[]}],"status":{"outage":["subscriptions_db"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID of the resource","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"x-mwb-tenant","required":false,"in":"header","description":"The tenant Id. It can be omitted if the auth token is authorized only for 1 specific tenant resource","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The create subscription Body","required":["id","query","immediate","emit_condition","output_schema","delivery"],"properties":{"id":{"title":"Subscription Id","type":"string"},"description":{"title":"Subscription description","type":"string"},"query":{"title":"Query. Defines which events belongs to this subscriptions. It should be a valid ES query","type":"object","additionalProperties":true},"immediate":{"title":"If true the events are not aggregated and emitted asap one at time","type":"boolean","default":false},"emit_condition":{"title":"Emit condition. Defines when the events belonging to this subscriptions should be emitted","type":"object","anyOf":[{"required":["condition"]},{"required":["time_window"]}],"properties":{"condition":{"title":"Emit condition expressed in JSON logic","type":"string"},"time_window":{"title":"Time window in seconds. After it expires the events will be emitted","type":"number"},"post_condition":{"title":"Emit condition expressed in JSON logic. evaluated after the time_window expires","type":"string"}}},"output_schema":{"title":"Output schema. Defines the scheme of the emitted notification","type":"object","required":["aggregations"],"properties":{"include":{"title":"Whether to include all events in the output, or only aggregations and subscription data","type":"string"},"aggregations":{"title":"Aggregated fields in the output","type":"array","items":{"title":"Aggregation object","type":"object","required":["name","operator"],"oneOf":[{"required":["field"],"properties":{"operator":{"enum":["MAX","MIN","MAP","SET","AVG","SUM","FIRST","LAST","VALUE"]}}},{"properties":{"operator":{"enum":["COUNT"]}}}],"properties":{"name":{"title":"field name in output schema","type":"string"},"field":{"title":"input field from the event","type":"string"},"operator":{"title":"aggregation operator","type":"string"}}}}}},"partition_keys":{"title":"Partition keys. Partition the events based on the values of the specified keys","type":"array","items":{"title":"Partition key","type":"string"}},"delivery":{"title":"Delivery information. Specify the delivery method","type":"object","required":["type"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook","email","slack","teams"]},"url":{"title":"Webhook url","type":"string"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},"filter":{"title":"Filter values for search optimization","type":"array","items":{"type":"string"}},"mapping_id":{"type":"string","title":"The mapping Id. If omitted or empty string, the default mapping will be used","pattern":"[a-z0-9\\-_+\\.]*"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) events"],"operationId":"api.v2.put.events.subscriptions"}},"/api/v2/cve":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search assets CVE result","properties":{"results":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"normalized_vendor":{"type":"string"},"display_vendor":{"type":"string"},"product":{"type":"string"},"normalized_product":{"type":"string"},"display_product":{"type":"string"},"installed_version":{"type":"string"},"normalized_installed_version":{"type":"string"},"display_installed_version":{"type":"string"},"installation_date":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"alias":{"type":"string"},"created_at":{"type":"string"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"cve_id":{"type":"string"},"cisa_exploitable":{"type":"boolean"},"known_ransomware_campaign_use":{"type":"boolean"},"severity":{"type":"string"},"severity_score":{"type":"number"},"published_at":{"type":"string"},"cvss30_score":{"type":"number"},"cvss20_score":{"type":"number"},"description":{"type":"string"},"ignored_until":{"type":"string","format":"date-time"},"ignored_by":{"type":"string"},"ignored_by_name":{"type":"string"},"ignored_reason":{"type":"string"},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["results","total_count"]}}}}},"tags":["V2 (legacy) cve"],"operationId":"api.v2.search.cve"}},"/api/v2/cve/search-groupby":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"x-mwb-accountid","required":true,"in":"header","description":"The X-mwb-accountid Schema","schema":{"type":"string"}},{"name":"x-mwb-clientid","required":false,"in":"header","description":"The X-mwb-clientid Schema","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"The Post CVE Search GroupBy Request Schema","required":["group_by","page_size"],"allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}],"properties":{"group_by":{"type":"string","title":"The groupBy Schema","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","host_name","fully_qualified_host_name","alias","created_at","os_type","os_version","os_platform","os_architecture","os_release_name","cve_id","cisa_exploitable","known_ransomware_campaign_use","severity","severity_score","published_at","cvss20_score","cvss30_score","domain_name","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}},{"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post CVE Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":"string","title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"fully_qualified_host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"tags":{"type":"object","additionalProperties":true,"title":"The tags Schema (only for machine_id aggregation)"},"account_id":{"type":"string","title":"The account_id Schema (only for machine_id aggregation)"},"group_name":{"type":"string","title":"The group name Schema (only for group_id aggregation)"},"account_name":{"type":"string","title":"The account_name Schema (only for account_id aggregation)"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (legacy) cve"],"operationId":"api.v2.search.cve.group"}},"/api/v2/integrations/pendo/event":{"post":{"status":{"outage":[]},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.post.pendo.event"}},"/api/v2/integrations/push-tokens":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","luna"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Push Token Register Schema","required":["token"],"properties":{"token":{"type":"string"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.delete.pushtokens"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["integrations.view"]}],"status":{"outage":["auth","luna"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Push Tokens Schema","required":["push_tokens"],"properties":{"push_tokens":{"type":"array","items":{"type":"object","title":"Push Token Schema","required":["token"],"properties":{"token":{"type":"string"},"active":{"type":"boolean"}}}}}}}}}},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.get.pushtokens"},"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","luna"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Push Token Register Schema","required":["token"],"properties":{"token":{"type":"string"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Push Token Schema","required":["token"],"properties":{"token":{"type":"string"},"active":{"type":"boolean"}}}}}}},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.post.pushtokens"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","luna"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Push Token Update Schema","required":["token","active"],"properties":{"token":{"type":"string"},"active":{"type":"boolean"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Push Token Schema","required":["token"],"properties":{"token":{"type":"string"},"active":{"type":"boolean"}}}}}}},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.put.pushtokens"}},"/api/v2/integrations/siem/{account_id}/notifications/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.deleteOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.delete.siem.notification"}},"/api/v2/integrations/siem/{account_id}/notifications":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["integrations.view"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"202":{"description":"response schema","content":{"application/json":{"schema":{}}}}},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.post.siem.notification"},"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The create notification Body","allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"delivery":{"title":"Delivery information. Specify the delivery method","type":"array","items":[{"title":"Sqs delivery","type":"object","required":["type","queue_url"],"properties":{"type":{"title":"Delivery method","type":"string","const":"sqs"},"queue_url":{"title":"SQS queue url","type":"string","format":"uri"}}}]},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true}}},{"anyOf":[{"properties":{"category":{"enum":["threats"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\",\"SA\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER","SA"]}},{"title":"0: \"action\". 1: \"blocked\", \"found\", \"quarantined\", \"deleted\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","found","quarantined","deleted","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]}]}}}},"responses":{"202":{"description":"response schema","content":{"application/json":{"schema":{}}}}},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.post.siem.notification"}},"/api/v2/integrations/slack/channels":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["integrations.view"]}],"status":{"outage":["auth","slackbot"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"prefix","required":false,"in":"query","description":"the prefix of the channels","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","description":"page size","schema":{"type":"string","pattern":"^\\d{1,4}$"}}],"responses":{},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.get.slack.channels"}},"/api/v2/integrations/slack/config":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","slackbot"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.delete.slack.config"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["integrations.view"]}],"status":{"outage":["auth","slackbot"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.get.slack.config"}},"/api/v2/integrations/slack/install":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","slackbot","pub_sub"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Interface for installing slack bot","required":["code"],"properties":{"code":{"type":"string","title":"the authorization code from slack oauth2"},"redirect_uri":{"type":"string","title":"the redirect_uri from slack oauth2"}}}}}},"responses":{},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.post.slack.install"}},"/api/v2/integrations/teams/conversations":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["integrations.view"]}],"status":{"outage":["auth","teamsbot"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"the next cursor","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","description":"page size","schema":{"type":"string","pattern":"^\\d{1,4}$"}}],"responses":{},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.get.teams.channels"}},"/api/v2/integrations/teams/config":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","teamsbot"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.delete.teams.config"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["integrations.view"]}],"status":{"outage":["auth","teamsbot"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.get.teams.config"}},"/api/v2/integrations/teams/install":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["integrations.manage"]}],"status":{"outage":["auth","teamsbot","pub_sub"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Interface for installing teams bot","required":["code"],"properties":{"code":{"type":"string","title":"the authorization code from teams oauth2"},"redirect_uri":{"type":"string","title":"the redirect_uri from teams oauth2"}}}}}},"responses":{},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.post.teams.install"}},"/api/v2/integrations/teams/message":{"post":{"status":{"outage":["auth","teamsbot"]},"responses":{},"tags":["V2 (legacy) integrations"],"operationId":"api.v2.post.teams.message"}},"/api/v2/rmm/detections/export":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["type","group_id","path","status","id","machine_id","account_id","account.name","group.name","detection_id","scanned_at","scanned_at_offset_seconds","reported_at","resource_created_at","resource_modified_at","category","is_rtp_stream_event","process_name","cleaned_at","machine_name","machine_ip","child_trace_count","source_location","destination_location","machine_location","trace_ip","trace_port","threat_name","is_root_detection","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.object_guid","rid_details.rule_id","rid_details.ip","rid_details.attack_user","rid_details.protocol","rid_details.port","rid_details.attempts","rid_details.duration","rid_details.create_time","rid_details.expire_time","sha256","md5","affected_application","scan_result.device.disk_model","action_taken"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","required":["account_ids"],"title":"List of queries to fetch endpoints","additionalProperties":true,"properties":{"account_ids":{"type":"array","title":"List of account IDs for this query","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Detections"],"operationId":"api.v2.rmm.post.export.detections"}},"/api/v2/rmm/detections/export/async":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["type","group_id","path","status","id","machine_id","account_id","account.name","group.name","detection_id","scanned_at","scanned_at_offset_seconds","reported_at","resource_created_at","resource_modified_at","category","is_rtp_stream_event","process_name","cleaned_at","machine_name","machine_ip","child_trace_count","source_location","destination_location","machine_location","trace_ip","trace_port","threat_name","is_root_detection","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.object_guid","rid_details.rule_id","rid_details.ip","rid_details.attack_user","rid_details.protocol","rid_details.port","rid_details.attempts","rid_details.duration","rid_details.create_time","rid_details.expire_time","sha256","md5","affected_application","scan_result.device.disk_model","action_taken"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","required":["account_ids"],"title":"List of queries to fetch endpoints","additionalProperties":true,"properties":{"account_ids":{"type":"array","title":"List of account IDs for this query","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Detections"],"operationId":"api.v2.rmm.post.export.detections.async"}},"/api/v2/rmm/accounts/{account_id}/detections/{id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get detection by id","additionalProperties":true,"required":["id","scan_id","machine_id","detection_id","scanned_at","scanned_at_local","reported_at","status","type","path","category"],"properties":{"id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"Scan ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"Endpoint ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"Machine name"},"group_id":{"type":"string","title":"Group ID the endpoint has (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_name":{"type":"string","title":"Group name the endpoint has"},"policy_id":{"type":"string","title":"The ID of the policy associated to the machine where this detection happened (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"policy_name":{"type":"string","title":"Policy name"},"detection_id":{"type":"string","title":"Detection id from endpoint"},"scanned_at":{"type":"string","title":"Scanned at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"Scanned at local time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"Detection reported at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"Status"},"action_taken":{"type":"string","title":"Action Taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"threat_name":{"type":"string","title":"Threat name"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Items"}},"path":{"type":"string","title":"Path"},"category":{"type":"string","title":"Category"},"ip_address":{"type":"string","title":"IP address"},"url":{"type":"string","title":"Url"},"port":{"type":"string","title":"Port"},"affected_application":{"type":"string","title":"Affected application"},"md5":{"type":"string","title":"Md5"},"process_name":{"type":"string","title":"Process name"},"auto_removal_at":{"type":["string","null"],"title":"Automatic removal timestamp","description":"When the quarantined item will be automatically removed.","format":"date-time","examples":["2020-03-23T17:23:17.860482Z"]}}}}}}},"tags":["V2 (RMM) Detections"],"operationId":"api.v2.rmm.get.detections.id"}},"/api/v2/rmm/detections":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search detections request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"scan_type":{"type":"string","title":"Type of the scan"},"schedule_id":{"type":"string","title":"ID of the schedule"},"schedule_etag":{"type":"string","title":"ETAG of the schedule"},"job_id":{"type":"string","title":"ID of the job originating this detection"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.browser_phishing_protection.plugin_version":{"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by engine version. This 'contains' type search will look for the exact match anywhere in the field."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"machine_name.keyword":{"type":"string","title":"The name of the machine. This 'contains' type search will look for the exact match anywhere in the field."},"machine_name":{"type":"string","title":"The name of the machine"},"process_name.keyword":{"type":"string","title":"The name of the process that originated this detection. This 'contains' type search will look for the exact match anywhere in the field."},"process_name":{"type":"string","title":"The name of the process that originated this detection"},"affected_application.keyword":{"type":"string","title":"The application affected by this detection. This 'contains' type search will look for the exact match anywhere in the field."},"affected_application":{"type":"string","title":"The application affected by this detection"},"category":{"type":"string","title":"The category of this detection"},"not.category":{"type":"string","title":"The category to exclude from search"},"md5":{"type":"string","title":"The md5 hash of this detection"},"sha256":{"type":"string","title":"The sha256 hash of this detection"},"path.keyword":{"type":"string","title":"The path where this detection happened. This 'contains' type search will look for the exact match anywhere in the field."},"path":{"type":"string","title":"The path where this detection happened"},"type":{"type":"string","title":"The type of the detection"},"not.type":{"type":"string","title":"The type to exclude from search"},"threat_name.keyword":{"type":"string","title":"The name of the threat. This 'contains' type search will look for the exact match anywhere in the field."},"threat_name":{"type":"string","title":"The name of the threat"},"status":{"type":"string","title":"The status of the detection"},"action_taken":{"type":"string","title":"The action taken of the detection","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"correlation_hash":{"type":"string","title":"The hash"},"group_id":{"type":"string","title":"The ID of the group to which the endpoint is assigned (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The ID of the endpoint (machine) where this detection originated (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"parent_detection_id":{"type":"string","title":"The ID of the parent detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The ID of the scan (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"trace_id":{"type":"string","title":"The ID of the parent trace (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"device_control.physical_disk_name":{"type":"string","title":"Physical disk name of device control detection (exact search)"},"not.device_control.physical_disk_name":{"type":"string","title":"Physical disk name of device control detection (contains search)"},"device_control.physical_disk_name.keyword":{"type":"string","title":"Physical disk name of device control detection. Search for the matches that are not equal to the value"},"not.device_control.physical_disk_name.keyword":{"type":"string","title":"Physical disk name of device control detection. Search for the matches that do not contain the value"},"start_date":{"type":"string","title":"Get results after this date. Defaults to 1 week if not specified. (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_after":{"type":"string","title":"Get results generated by a scan happening after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_before":{"type":"string","title":"Get results generated by a scan happening before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_after":{"type":"string","title":"Get results reported after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_before":{"type":"string","title":"Get results reported before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_after":{"type":"string","title":"Get results cleaned after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_before":{"type":"string","title":"Get results cleaned before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"is_root_detection":{"type":"boolean","title":"Whether this detection is the root detection"},"is_rtp_stream_event":{"type":"boolean","title":"Whether this is a Real-Time Protectionevent"},"object_guid":{"type":"string","title":"object_guid filter"},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","sha256","affected_application.keyword","process_name.keyword","machine_name.keyword","scanned_at","reported_at","resource_created_at","resource_modified_at","cleaned_at","is_root_detection","is_rtp_stream_event","object_guid","scan_result.device.disk_model"]},"sort_order":{"type":"string","title":"Sorting direction","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","scan_result.device.disk_model","category_by_status"]}},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populate with the group data"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (agent, machine_location)"},"scan_result":{"type":"boolean","title":"Populate with the scan_result data"}}},"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"aggregate_by_account":{"type":"boolean"}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search detections result","properties":{"detections":{"type":"array","title":"Detections","items":{"type":"object","title":"Detection items","additionalProperties":false,"properties":{"id":{"type":"string","title":"ID"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Type items"}},"status":{"type":"string","title":"Status"},"path":{"type":"string","title":"Path"},"group_id":{"type":"string","title":"Group ID"},"group":{"type":"object","title":"The Group Schema","additionalProperties":true},"is_root_detection":{"type":"boolean","title":"Is root detection"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"detection_id":{"type":"string","title":"Detection ID"},"scanned_at":{"type":"string","title":"Scanned at"},"scanned_at_offset_seconds":{"type":"integer","title":"Scanned at offset seconds"},"reported_at":{"type":"string","title":"Reported at"},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"threat_name":{"type":"string","title":"Threat name"},"category":{"type":"string","title":"Category"},"action_taken":{"type":"string","title":"Action taken"},"is_rtp_stream_event":{"type":"boolean","title":"Is rtp stream event"},"process_name":{"type":"string","title":"Process name"},"cleaned_at":{"type":"string","title":"Cleaned at"},"machine_name":{"type":"string","title":"Endpoint name"},"trace_id":{"type":"string","title":"Trace ID"},"scan_id":{"type":"string","title":"Scan ID"},"affected_application":{"type":"string","title":"Affected application"},"last_user":{"type":"string","title":"Last user"},"md5":{"type":"string","title":"MD5"},"sha256":{"type":"string","title":"SHA256"},"machine_ip":{"type":"string","title":"Machine IP address"},"child_trace_count":{"type":"integer","title":"Child trace count"},"agent":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"at":"2020-10-23T14:20:51.006558Z","is_software_update_available":false,"started_at_local":"2020-10-23T14:20:50.920306Z","started_at_offset":-25200,"nics":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"os_info":{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"},"fully_qualified_host_name":"sahamedw8-1x86","plugins":{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}},"engine_version":"1.2.0.821","policy_etag":"c6ea44914b72c92cba939ac3bd369dc4","last_user":"SAHAMEDW8-1X86\\Administrator","serial_number":"c02thb32g8wn","host_name":"sahamedw8-1x86","machine_id":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","machine_ip":"216.75.233.210"}],"properties":{"at":{"type":"string","title":"The at schema","default":"","examples":["2020-10-23T14:20:51.006558Z"]},"is_software_update_available":{"type":"boolean","title":"The is_software_update_available schema","default":false,"examples":[false]},"started_at_local":{"type":"string","title":"The started_at_local schema","default":"","examples":["2020-10-23T14:20:50.920306Z"]},"started_at_offset":{"type":"integer","title":"The started_at_offset schema","default":0,"examples":[-25200]},"nics":{"type":"array","title":"The nics schema","default":[],"examples":[[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}]],"additionalItems":true,"items":{"anyOf":[{"type":"object","title":"The first anyOf schema","default":{},"examples":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"properties":{"ips":{"type":"array","title":"The ips schema","default":[],"examples":[["10.151.110.52"]],"additionalItems":true,"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["10.151.110.52"]}]}},"description":{"type":"string","title":"The description schema","default":"","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"The mac_address schema","default":"","examples":["005056B91173"]}},"additionalProperties":true}]}},"os_info":{"type":"object","title":"The os_info schema","default":{},"examples":[{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"}],"properties":{"os_type":{"type":"string","title":"The os_type schema","default":"","examples":["Workstation"]},"os_version":{"type":"string","title":"The os_version schema","default":"","examples":["6.3.9600"]},"os_platform":{"type":"string","title":"The os_platform schema","default":"","examples":["Windows"]},"os_architecture":{"type":"string","title":"The os_architecture schema","default":"","examples":["x86"]},"os_release_name":{"type":"string","title":"The os_release_name schema","default":"","examples":["Microsoft Windows 8.1 Pro"]}},"additionalProperties":true},"fully_qualified_host_name":{"type":"string","title":"The fully_qualified_host_name schema","default":"","examples":["sahamedw8-1x86"]},"plugins":{"type":"object","title":"The plugins schema","default":{},"examples":[{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}}],"properties":{"windows_remote_intrusion_detection_and_prevention":{"type":"object","title":"The windows_remote_intrusion_detection_and_prevention schema","default":{},"examples":[{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Windows Remote Intrusion Detection and Prevention"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.21"]}},"additionalProperties":true},"endpoint_protection":{"type":"object","title":"The endpoint_protection schema","default":{},"examples":[{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0}],"properties":{"sdk_version":{"type":"string","title":"The sdk_version schema","default":"","examples":["4.2.1.90"]},"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Protection"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.844"]},"update_package_version":{"type":"string","title":"The update_package_version schema","default":"","examples":["1.0.31870"]},"component_package_version":{"type":"string","title":"The component_package_version schema","default":"","examples":["1.0.1085"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"asset_manager":{"type":"object","title":"The asset_manager schema","default":{},"examples":[{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Asset Manager"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.330"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"endpoint_detection_and_response":{"type":"object","title":"The endpoint_detection_and_response schema","default":{},"examples":[{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Detection and Response"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.297"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true}},"additionalProperties":true},"engine_version":{"type":"string","title":"The engine_version schema","default":"","examples":["1.2.0.821"]},"policy_etag":{"type":"string","title":"The policy_etag schema","default":"","examples":["c6ea44914b72c92cba939ac3bd369dc4"]},"last_user":{"type":"string","title":"The last_user schema","default":"","examples":["SAHAMEDW8-1X86\\Administrator"]},"host_name":{"type":"string","title":"The host_name schema","default":"","examples":["sahamedw8-1x86"]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"machine_ip":{"type":"string","title":"The machine_ip schema","default":"","examples":["216.75.233.210"]},"object_guid":{"type":"string","title":"The object_guid schema","default":""}}},{"title":"Agent information. Included if the request includes populate 'endpoint'"}]},"machine_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Machine location. Included if the request includes populate 'endpoint'"}]},"source_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Source location for RID category"}]},"destination_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Destination location for RID category"}]},"account":{"parent":{"title":"Parent account ID","type":"string"},"name":{"title":"Account name","type":"string"},"deleted":{"title":"Account deleted","type":"boolean"},"options":{"type":"object","properties":{"msp":{"type":"object","properties":{"name":{"type":"string"}}}}}},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}},"rid_details":{"type":"object","title":"Remote intrusion detection details","properties":{"rule_id":{"type":"string"},"ip":{"type":"string"},"attack_user":{"type":"string"},"protocol":{"type":"string"},"port":{"type":"integer"},"attempts":{"type":"integer"},"duration":{"type":"integer"},"create_time":{"type":"string"},"expire_time":{"type":"string"},"deleted":{"type":"boolean"},"document_id":{"type":"string"},"version":{"type":"integer"}}},"device_control":{"type":"object","title":"Device control object schema","properties":{"timestamp":{"type":"string","description":"Timestamp of the detection"},"physical_disk_name":{"type":"string","description":"Physical disk name"},"device_id":{"type":"string","description":"Device ID"},"disk_interface":{"type":"string","description":"Disk interface"},"manufacturer":{"type":"string","decription":"Manufacturer"},"serial_number":{"type":"string","description":"Serial number"},"drive_compressed":{"type":"boolean","description":"Boolean field to indicate if drive is compressed"},"file_system":{"type":"string","description":"File system"},"volume_name":{"type":"string","description":"Volume name"},"volume_serial":{"type":"string","description":"Volume serial number"},"volume_device_path":{"type":"string","description":"Volume device path"},"block_status":{"type":"string","description":"Block status"},"drive_metadata":{"type":"object","decription":"Drive metadata","additionalProperties":true},"pnp_device_id":{"type":"string","decription":"PNP device ID"},"scanned_at":{"type":"string","description":"Scanned at"}}},"scan_result":{"title":"Scan Result. Included if the request includes populate 'scan_result'","type":"object","properties":{"scan_id":{"type":"string"},"account_id":{"type":"string"},"machine_id":{"type":"string"},"reported_at":{"type":"string"},"scan_type":{"type":"string"},"started_at":{"type":"string"},"started_at_offset_seconds":{"type":"integer"},"duration":{"allOf":[{"bignumber":true},{"type":"number"}]},"found_count":{"type":"integer"},"quarantined_count":{"type":"integer"},"deleted_count":{"type":"integer"},"device":{"type":"object","title":"Device control object schema","properties":{"timestamp":{"type":"string","description":"Timestamp of the detection"},"physical_disk_name":{"type":"string","description":"Physical disk name"},"device_id":{"type":"string","description":"Device ID"},"disk_interface":{"type":"string","description":"Disk interface"},"manufacturer":{"type":"string","decription":"Manufacturer"},"serial_number":{"type":"string","description":"Serial number"},"drive_compressed":{"type":"boolean","description":"Boolean field to indicate if drive is compressed"},"file_system":{"type":"string","description":"File system"},"volume_name":{"type":"string","description":"Volume name"},"volume_serial":{"type":"string","description":"Volume serial number"},"volume_device_path":{"type":"string","description":"Volume device path"},"block_status":{"type":"string","description":"Block status"},"drive_metadata":{"type":"object","decription":"Drive metadata","additionalProperties":true},"pnp_device_id":{"type":"string","decription":"PNP device ID"},"scanned_at":{"type":"string","description":"Scanned at"}}},"metadata":{"properties":{"application_version":{"type":"string"},"components_update_package_version":{"type":"string"},"cpu":{"type":"string"},"db_sdk_update_package_version":{"type":"string"},"detection_date_time":{"type":"string"},"file_system":{"type":"string"},"files_detected":{"type":"integer"},"folders_detected":{"type":"integer"},"id":{"type":"string"},"license_state":{"type":"string"},"logged_on_user_name":{"type":"string"},"modules_detected":{"type":"integer"},"os":{"type":"string"},"processes_detected":{"type":"integer"},"registry_data_detected":{"type":"integer"},"registry_keys_detected":{"type":"integer"},"registry_values_detected":{"type":"integer"},"schema_version":{"type":"integer"},"source_details":{"properties":{"objects_scanned":{"type":"integer"},"scan_duration_secs":{"type":"integer"},"scan_options":{"properties":{"pum_handling":{"type":"string"},"pup_handling":{"type":"string"},"scan_archives":{"type":"boolean"},"scan_file_system":{"type":"boolean"},"scan_memory_objects":{"type":"boolean"},"scan_pums":{"type":"boolean"},"scan_pups":{"type":"boolean"},"scan_rootkits":{"type":"boolean"},"scan_startup_and_registry":{"type":"boolean"},"scan_type":{"type":"string"},"use_heuristics":{"type":"boolean"}}},"scan_result":{"type":"string"},"type":{"type":"string"}}},"user_admin":{"type":"boolean"}}},"schedule_id":{"type":"string"},"schedule_etag":{"type":"string"},"job_id":{"type":"string"}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Detections"],"operationId":"api.v2.rmm.search.detections"}},"/api/v2/rmm/accounts/{account_id}/detections/submit-fp":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["detections.performActions"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"description":"Submit Web Detection False Positive Request","type":"object","allOf":[{"description":"Submit Web Detection False Positive Request","type":"object","required":["ids"],"properties":{"ids":{"type":"array","items":{"type":"string","description":"The ID of the detection to be marked as false positive. The ID is a UUIDv4 string.","format":"uuid"}},"additional_info":{"type":"string","description":"Additional information about the false positive"},"start_date":{"type":"string","description":"The start date of the detection","format":"date-time"},"end_date":{"type":"string","description":"The end date of the detection","format":"date-time"}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Detections"],"operationId":"api.v2.rmm.detections.submit.fp"}},"/api/v2/rmm/assets/software/export":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["softwareInventory.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","parent_account_id","group_id","root_group_id","group_name","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","account_name","host_name","fully_qualified_host_name","domain_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","ignored_until","ignore_rule_ids","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch endpoints","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}},{"properties":{"groups":{"type":"array","title":"List of search queries","items":{"allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Assets"],"operationId":"api.v2.rmm.post.export.assets.software"}},"/api/v2/rmm/assets/software/export/async":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["softwareInventory.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","parent_account_id","group_id","root_group_id","group_name","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","account_name","host_name","fully_qualified_host_name","domain_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","ignored_until","ignore_rule_ids","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch endpoints","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}},{"properties":{"groups":{"type":"array","title":"List of search queries","items":{"allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Assets"],"operationId":"api.v2.rmm.post.export.assets.software.async"}},"/api/v2/rmm/assets/software":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["softwareInventory.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search assets software result","properties":{"assets":{"type":"array","items":{"properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"normalized_vendor":{"type":"string"},"display_vendor":{"type":"string"},"product":{"type":"string"},"normalized_product":{"type":"string"},"display_product":{"type":"string"},"installed_version":{"type":"string"},"normalized_installed_version":{"type":"string"},"display_installed_version":{"type":"string"},"installation_date":{"type":"string"},"language":{"type":"string"},"architecture":{"type":"string"},"product_signature":{"type":"integer"},"categories":{"type":"array","items":{"type":"integer"}},"account_name":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"domain_name":{"type":"string"},"alias":{"type":"string"},"created_at":{"type":"string"},"object_guid":{"type":"string"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"group_name":{"type":"string"},"policy_id":{"type":"string"},"policy_name":{"type":"string"},"cves":{"type":"array","items":{"type":"string"}},"cves_count":{"type":"integer"},"cves_score":{"type":"number"},"cves_by_status":{"properties":{"none":{"type":"array","items":{"type":"string"}},"low":{"type":"array","items":{"type":"string"}},"medium":{"type":"array","items":{"type":"string"}},"high":{"type":"array","items":{"type":"string"}},"critical":{"type":"array","items":{"type":"string"}}}},"cves_count_by_status":{"properties":{"none":{"type":"integer"},"low":{"type":"integer"},"medium":{"type":"integer"},"high":{"type":"integer"},"critical":{"type":"integer"}}},"latest_version_available":{"type":"string"},"ignored_until":{"type":"string","format":"date-time"},"ignore_rule_ids":{"type":"array","items":{"type":"string","format":"uuid"}},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}},"ai_tool":{"type":["string","null"],"title":"Canonical AI tool name. null if not an AI tool."},"ai_category":{"type":["string","null"],"title":"AI tool category, e.g. \"AI Assistant\", \"AI Code Tool\"."},"ai_risk":{"type":["string","null"],"title":"Risk level from the AI whitelist.","enum":["Low","Medium","High",null]},"ai_tier":{"type":["string","null"],"title":"Confidence/tier from the AI whitelist."},"ai_flags":{"type":"array","title":"Zero or more AI whitelist flags, e.g. \"browser_access\", \"local_llm_execution\".","items":{"type":"string"}},"ai_status":{"type":["string","null"],"title":"Effective governance status resolved from AIDR rules. null when ai_tool is null.","enum":["authorized","unauthorized","pending",null]}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["assets","total_count"]}}}}},"tags":["V2 (RMM) Assets"],"operationId":"api.v2.rmm.search.assets.software"}},"/api/v2/rmm/assets/software/search-groupby":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["softwareInventory.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"The Post Assets Search GroupBy Request","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"required":["group_by","page_size"],"properties":{"group_by":{"type":"string","title":"The sort field Schema","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","created_at","domain_name","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":"string","title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"fully_qualified_host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"tags":{"type":"object","additionalProperties":true,"title":"The tags Schema (only for machine_id aggregation)"},"account_id":{"type":"string","title":"The account_id Schema (only for machine_id aggregation)"},"group_name":{"type":"string","title":"The group name Schema (only for group_id aggregation)"},"account_name":{"type":"string","title":"The account_name Schema (only for group_id and account_id aggregation)"},"signature_name":{"type":"string","title":"The signature_name Schema (only for product_signature aggregation)"},"vendor":{"type":"string","title":"The vendor Schema (only for product_signature aggregation)"},"platform":{"type":"string","title":"The platform Schema (only for product_signature aggregation)"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Assets"],"operationId":"api.v2.rmm.search.assets.software.group"}},"/api/v2/rmm/cve/export":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","group_name","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","host_name","fully_qualified_host_name","domain_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","cisa_exploitable","known_ransomware_campaign_use","severity","severity_score","published_at","description","cvss20_score","cvss30_score","latest_version_available","product_signature","architecture","language","supports_update","supports_uninstall","ignored_until","ignored_by","ignored_by_name","ignored_reason","ignored_at","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch CVEs","allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}}],"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","required":["account_ids"],"allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Vulnerability Management"],"operationId":"api.v2.rmm.post.export.cve"}},"/api/v2/rmm/cve/export/async":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","group_name","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","host_name","fully_qualified_host_name","domain_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","cisa_exploitable","known_ransomware_campaign_use","severity","severity_score","published_at","description","cvss20_score","cvss30_score","latest_version_available","product_signature","architecture","language","supports_update","supports_uninstall","ignored_until","ignored_by","ignored_by_name","ignored_reason","ignored_at","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch CVEs","allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}}],"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","required":["account_ids"],"allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Vulnerability Management"],"operationId":"api.v2.rmm.post.export.cve.async"}},"/api/v2/rmm/cve/{id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","properties":{"cve":{"type":"string","title":"CVE identifier"},"cwe":{"type":"string","title":"CWE identifier"},"is_cisa_exploitable":{"type":"boolean","title":"whether is cisa exploitable"},"known_ransomware_campaign_use":{"type":"boolean","title":"whether is known to be used in ransomware campaigns"},"published_epoch":{"type":"integer","title":"Published epoch"},"last_modified_epoch":{"type":"integer","title":"last modified epoch"},"references":{"title":"List of references","type":"array","items":[{"type":"object","properties":{"url":{"type":"string"},"name":{"type":"string"},"reference_type":{"type":"string"},"source":{"type":"string"}},"required":["url","name","reference_type","source"]}]},"cvss_2_0":{"type":"object","properties":{"score":{"type":"string"},"access_vector":{"type":"string"},"access_complexity":{"type":"string"},"authentication":{"type":"string"},"confidentiality_impact":{"type":"string"},"integrity_impact":{"type":"string"},"availability_impact":{"type":"string"},"source":{"type":"string"},"impact_score":{"type":"string"},"exploitability_score":{"type":"string"}},"required":["score","access_vector","access_complexity","authentication","confidentiality_impact","integrity_impact","availability_impact","source","impact_score","exploitability_score"]},"severity_index":{"type":"integer"},"severity":{"type":"string"},"vulnerable_software_list":{"type":"array","items":[{"type":"string"}]},"cvss_3_0":{"type":"object","properties":{"impact_score":{"type":"string"},"vector_string":{"type":"string"},"attack_vector":{"type":"string"},"attack_complexity":{"type":"string"},"privileges_required":{"type":"string"},"user_interaction":{"type":"string"},"scope":{"type":"string"},"confidentiality_impact":{"type":"string"},"integrity_impact":{"type":"string"},"availability_impact":{"type":"string"},"base_score":{"type":"string"},"base_severity":{"type":"string"},"exploitability_score":{"type":"string"},"opswat_temporal_score":{"type":"object","properties":{"exploitability":{"type":"string"},"remediation_level":{"type":"string"},"report_confidence":{"type":"string"},"temporal_score":{"type":"string"},"generated_on_epoch":{"type":"integer"},"cve_last_modified_epoch":{"type":"integer"}},"required":["exploitability","remediation_level","report_confidence","temporal_score","generated_on_epoch","cve_last_modified_epoch"]},"revision":{"type":"string"}},"required":["impact_score","vector_string","attack_vector","attack_complexity","privileges_required","user_interaction","scope","confidentiality_impact","integrity_impact","availability_impact","base_score","base_severity","exploitability_score","opswat_temporal_score","revision"]},"resolution":{"type":"array","items":[{"type":"object","properties":{"product_id":{"type":"integer"},"signature_ids":{"type":"array","items":{"type":"number"}},"product_name":{"type":"string"},"text":{"type":"string"},"advisory_url":{"type":"string"},"higher_than_version":{"type":"string"},"higher_than_or_equal_to_version":{"type":"string"}},"required":["product_id","product_name"]}]},"opswat_product_info":{"type":"array","items":[{"type":"object","properties":{"product":{"type":"object","properties":{"name":{"type":"string"},"id":{"type":"integer"}},"required":["name","id"]},"ranges":{"type":"array","items":[{"type":"object","properties":{"start":{"type":"string"},"limit":{"type":"string"}},"required":["start","limit"]}]},"vendor":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"]}},"required":["product","ranges","vendor"]},{"type":"object","properties":{"product":{"type":"object","properties":{"name":{"type":"string"},"id":{"type":"integer"}},"required":["name","id"]},"ranges":{"type":"array","items":[{"type":"object","properties":{"start":{"type":"string"},"limit":{"type":"string"}},"required":["start","limit"]}]},"vendor":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"]}},"required":["product","ranges","vendor"]}]},"description":{"type":"string"}},"required":["cve","published_epoch","last_modified_epoch","references","cvss_2_0","severity_index","severity","vulnerable_software_list","description"]}}}}},"tags":["V2 (RMM) Vulnerability Management"],"operationId":"api.v2.rmm.get.cve.id"}},"/api/v2/rmm/cve/bulk":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get CVE-s by CVE IDs","required":["ids"],"properties":{"ids":{"type":"array","items":{"type":"string"},"title":"CVE IDs to search for"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"array","title":"Get CVEs","items":{"type":"object","properties":{"cve":{"type":"string","title":"CVE identifier"},"cwe":{"type":"string","title":"CWE identifier"},"is_cisa_exploitable":{"type":"boolean","title":"whether is cisa exploitable"},"known_ransomware_campaign_use":{"type":"boolean","title":"whether is known to be used in ransomware campaigns"},"published_epoch":{"type":"integer","title":"Published epoch"},"last_modified_epoch":{"type":"integer","title":"last modified epoch"},"references":{"title":"List of references","type":"array","items":[{"type":"object","properties":{"url":{"type":"string"},"name":{"type":"string"},"reference_type":{"type":"string"},"source":{"type":"string"}},"required":["url","name","reference_type","source"]}]},"cvss_2_0":{"type":"object","properties":{"score":{"type":"string"},"access_vector":{"type":"string"},"access_complexity":{"type":"string"},"authentication":{"type":"string"},"confidentiality_impact":{"type":"string"},"integrity_impact":{"type":"string"},"availability_impact":{"type":"string"},"source":{"type":"string"},"impact_score":{"type":"string"},"exploitability_score":{"type":"string"}},"required":["score","access_vector","access_complexity","authentication","confidentiality_impact","integrity_impact","availability_impact","source","impact_score","exploitability_score"]},"severity_index":{"type":"integer"},"severity":{"type":"string"},"vulnerable_software_list":{"type":"array","items":[{"type":"string"}]},"cvss_3_0":{"type":"object","properties":{"impact_score":{"type":"string"},"vector_string":{"type":"string"},"attack_vector":{"type":"string"},"attack_complexity":{"type":"string"},"privileges_required":{"type":"string"},"user_interaction":{"type":"string"},"scope":{"type":"string"},"confidentiality_impact":{"type":"string"},"integrity_impact":{"type":"string"},"availability_impact":{"type":"string"},"base_score":{"type":"string"},"base_severity":{"type":"string"},"exploitability_score":{"type":"string"},"opswat_temporal_score":{"type":"object","properties":{"exploitability":{"type":"string"},"remediation_level":{"type":"string"},"report_confidence":{"type":"string"},"temporal_score":{"type":"string"},"generated_on_epoch":{"type":"integer"},"cve_last_modified_epoch":{"type":"integer"}},"required":["exploitability","remediation_level","report_confidence","temporal_score","generated_on_epoch","cve_last_modified_epoch"]},"revision":{"type":"string"}},"required":["impact_score","vector_string","attack_vector","attack_complexity","privileges_required","user_interaction","scope","confidentiality_impact","integrity_impact","availability_impact","base_score","base_severity","exploitability_score","opswat_temporal_score","revision"]},"resolution":{"type":"array","items":[{"type":"object","properties":{"product_id":{"type":"integer"},"signature_ids":{"type":"array","items":{"type":"number"}},"product_name":{"type":"string"},"text":{"type":"string"},"advisory_url":{"type":"string"},"higher_than_version":{"type":"string"},"higher_than_or_equal_to_version":{"type":"string"}},"required":["product_id","product_name"]}]},"opswat_product_info":{"type":"array","items":[{"type":"object","properties":{"product":{"type":"object","properties":{"name":{"type":"string"},"id":{"type":"integer"}},"required":["name","id"]},"ranges":{"type":"array","items":[{"type":"object","properties":{"start":{"type":"string"},"limit":{"type":"string"}},"required":["start","limit"]}]},"vendor":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"]}},"required":["product","ranges","vendor"]},{"type":"object","properties":{"product":{"type":"object","properties":{"name":{"type":"string"},"id":{"type":"integer"}},"required":["name","id"]},"ranges":{"type":"array","items":[{"type":"object","properties":{"start":{"type":"string"},"limit":{"type":"string"}},"required":["start","limit"]}]},"vendor":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"]}},"required":["product","ranges","vendor"]}]},"description":{"type":"string"}},"required":["cve","published_epoch","last_modified_epoch","references","cvss_2_0","severity_index","severity","vulnerable_software_list","description"]}}}}}},"tags":["V2 (RMM) Vulnerability Management"],"operationId":"api.v2.rmm.get.cves.bulk"}},"/api/v2/rmm/cve/ignore":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["vulnerabilities.manage"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Ignore CVE Request","description":"Request body for ignoring CVEs","allOf":[{"type":"object","title":"Ignore CVE Request","description":"Request body for ignoring CVEs","properties":{"action":{"type":"string","enum":["ignore","update","unignore"],"description":"The action to perform on the CVEs. Use 'ignore' to ignore and 'unignore' to remove the ignore status.","default":"ignore"},"ignored_reason":{"type":"string","description":"The reason for ignoring the CVEs"},"ignored_until":{"type":["string","null"],"format":"date-time","description":"The date until which the CVEs should be ignored. Omit to ignore indefinitely."},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch CVEs","allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}},"required":["groups"],"if":{"properties":{"action":{"const":"unignore"}},"required":["action"]},"then":{"not":{"anyOf":[{"required":["ignored_reason"]},{"required":["ignored_until"]}]},"errorMessage":"The 'ignored_reason' and 'ignored_until' fields must not be provided when unignoring CVEs."}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Vulnerability Management"],"operationId":"api.v2.rmm.ignore.cve"}},"/api/v2/rmm/cve":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}],"properties":{"aggregate_by_account":{"type":"boolean","title":"Include aggregation results per account"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search assets CVE result","properties":{"results":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"normalized_vendor":{"type":"string"},"display_vendor":{"type":"string"},"product":{"type":"string"},"normalized_product":{"type":"string"},"display_product":{"type":"string"},"installed_version":{"type":"string"},"normalized_installed_version":{"type":"string"},"display_installed_version":{"type":"string"},"installation_date":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"alias":{"type":"string"},"created_at":{"type":"string"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"cve_id":{"type":"string"},"cisa_exploitable":{"type":"boolean"},"known_ransomware_campaign_use":{"type":"boolean"},"severity":{"type":"string"},"severity_score":{"type":"number"},"published_at":{"type":"string"},"cvss30_score":{"type":"number"},"cvss20_score":{"type":"number"},"description":{"type":"string"},"ignored_until":{"type":"string","format":"date-time"},"ignored_by":{"type":"string"},"ignored_by_name":{"type":"string"},"ignored_reason":{"type":"string"},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["results","total_count"]}}}}},"tags":["V2 (RMM) Vulnerability Management"],"operationId":"api.v2.rmm.search.cve"}},"/api/v2/rmm/cve/search-groupby":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["vulnerabilities.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"The Post CVE Search GroupBy Request Schema","required":["group_by","page_size"],"allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}],"properties":{"group_by":{"type":"string","title":"The groupBy Schema","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","host_name","fully_qualified_host_name","alias","created_at","os_type","os_version","os_platform","os_architecture","os_release_name","cve_id","cisa_exploitable","known_ransomware_campaign_use","severity","severity_score","published_at","cvss20_score","cvss30_score","domain_name","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post CVE Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":"string","title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"fully_qualified_host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"tags":{"type":"object","additionalProperties":true,"title":"The tags Schema (only for machine_id aggregation)"},"account_id":{"type":"string","title":"The account_id Schema (only for machine_id aggregation)"},"group_name":{"type":"string","title":"The group name Schema (only for group_id aggregation)"},"account_name":{"type":"string","title":"The account_name Schema (only for account_id aggregation)"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Vulnerability Management"],"operationId":"api.v2.rmm.search.cve.group"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["endpoints.delete"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":["object","null"],"title":"Delete endpoint request","properties":{"unregister_isolated":{"type":"boolean","title":"Force delete isolated endpoints"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.delete.endpoint"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate_diag_info","required":false,"in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoint By Id Body 200 Schema","required":["id","policy_id","group_id","name","online","is_deleted"],"properties":{"id":{"type":"string","title":"ID of the endpoint (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"policy_id":{"type":"string","title":"ID of the policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_id":{"type":"string","title":"ID of the group (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"The Name of the endpoint"},"online":{"type":"boolean","title":"Whether the endpoint is online or not"},"is_deleted":{"type":"boolean","title":"Whether the endpoint was deleted"},"os_architecture":{"type":"string","title":"OS architecture"},"os_platform":{"type":"string","title":"OS platform"},"os_release_name":{"type":"string","title":"OS release name"},"tags":{"type":"object","title":"Tags for this machine","additionalProperties":true},"last_seen_at":{"type":"string","title":"The last time the endpoint checked in as online (max 1 per hour) (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"diag_info":{"type":"object","title":"Information on diagnostic logs","properties":{"has_diag_logs":{"type":"boolean","title":"Indicates whether diagnostic logs are available"}}}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.get.endpoint.id"}},"/api/v2/rmm/endpoints":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["endpoints.delete"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Delete in bulk","required":["endpoints","groups"],"properties":{"endpoints":{"type":"array","title":"Endpoints","items":{"type":"object","title":"Endpoint items","required":["id","account_id"],"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"List of queries to fetch endpoints","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing  a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan  before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}]}},"unregister_isolated":{"type":"boolean","title":"Force delete isolated endpoints"},"endpoint_count_confirmation":{"type":"integer","minimum":1,"title":"Expected total number of endpoints to delete. Deletion proceeds only if the actual count matches this value."}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Delete Endpoints Bulk Body 200 Schema","required":["deleted"],"properties":{"deleted":{"type":"array","title":"IDs of the deleted endpoint","items":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.delete.endpoints.bulk"},"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"incident":["read_nebula_data","caching"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing  a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan  before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search endpoints","required":["endpoints","total_count","next_cursor"],"properties":{"aggregations":{"type":"object","additionalProperties":true},"endpoints":{"type":"array","title":"Endpoints","items":{"type":"object","title":"Endpoint items","additionalProperties":true,"properties":{"link":{"type":"string","title":"Link"},"protection_status":{"type":"string","title":"Protection Status"},"display_name":{"type":"string","title":"Display Name"},"agent":{"type":"object","title":"Agent","additionalProperties":true,"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"last_user":{"type":"string","title":"The last user logging in"},"at":{"type":"string","title":"Reported At"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"nics":{"type":"array","title":"Nics","items":{"type":"object","title":"Nics items","properties":{"ips":{"type":"array","title":"IPs","items":{"type":"string","title":"IP items"}},"description":{"type":"string","title":"Description"},"mac_address":{"type":"string","title":"Mac address"}}}},"os_info":{"type":"object","title":"Os info","properties":{"os_type":{"type":"string","title":"OS type"},"os_version":{"type":"string","title":"OS version"},"os_platform":{"type":"string","title":"OS platform"},"os_architecture":{"type":"string","title":"OS architecture"},"os_release_name":{"type":"string","title":"OS release name"}}},"domain_name":{"type":"string","title":"Domain name"},"host_name":{"type":"string","title":"Host name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified host name"},"object_guid":{"type":"string","title":"Object guid"},"plugins":{"type":"object","title":"Plugins","properties":{"incident_response":{"type":"object","title":"Incident response","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"update_package_version":{"type":"string","title":"Update package version"},"component_package_version":{"type":"string","title":"Component package version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_protection":{"type":"object","title":"Endpoint protection plugin","properties":{"sdk_version":{"type":"string","title":"SDK version plugin"},"product_name":{"type":"string","title":"Name of the product"},"plugin_version":{"type":"string","title":"Version of the product"},"update_package_version":{"type":"string","title":"Update version"},"component_package_version":{"type":"string","title":"Component version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"asset_manager":{"type":"object","title":"Asset manager","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_detection_and_response":{"type":"object","title":"Endpoint detection and response","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}}}},"engine_version":{"type":"string","title":"Engine version"},"policy_etag":{"type":"string","title":"Policy etag"},"version":{"type":"integer","title":"Version"},"document_id":{"type":"string","title":"Document ID"},"machine_ip":{"type":"string","title":"Machine public IP"},"source_location":{"type":"object","properties":{"city":{"type":"string"},"country":{"type":"string"},"country_iso":{"type":"string"},"continent":{"type":"string"},"accuracy_radius":{"type":"integer"},"point":{"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number"}]},"lon":{"allOf":[{"bignumber":true},{"type":"number"}]}}},"time_zone":{"type":"string"},"postal_code":{"type":"string"},"subdivisions":{"type":"array","items":{"type":"string"}},"anonymous_proxy":{"type":"boolean"}}},"serial_number":{"type":"string","title":"Serial number of this endpoint"},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}},"machine":{"type":"object","title":"Endpoint","additionalProperties":true,"properties":{"id":{"type":"string","title":"ID"},"job":{"type":"object","title":"The last job","additionalProperties":true},"account":{"type":"object","title":"Account","additionalProperties":true},"online":{"type":"boolean","title":"Is online"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"root_group_id":{"type":"string","title":"Root group ID"},"group_name":{"type":"string","title":"Group name"},"policy_id":{"type":"string","title":"Policy id"},"policy_account_id":{"type":"string","title":"Policy account ID"},"policy_name":{"type":"string","title":"Policy name"},"last_day_seen":{"type":"string","title":"Last day seen"},"last_active":{"type":"string","title":"Last time the endpoint connected to Nebula in real time"},"isolated":{"type":"boolean","title":"Is isolated"},"scan_age_days":{"type":"integer","title":"Days from last scan"},"suspicious_activity_count":{"type":"integer","title":"Count of suspicious activities"},"infection_count":{"type":"integer","title":"Count of infections found"},"reboot_required":{"type":"integer","title":"Is reboot required"},"last_scanned_at":{"type":"string","title":"Last scanned at"},"is_deleted":{"type":"boolean","title":"Is deleted"},"version":{"type":"integer","title":"Version"},"document_id":{"type":"string","title":"Document ID"},"created_at":{"type":"string","format":"date-time","title":"Created At"}}},"machineVersion":{"type":"integer","title":"Machine version"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"after":{"type":"string","title":"After cursor"}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.post.endpoints"}},"/api/v2/rmm/endpoints/export":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["endpoints","groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["machine.is_deleted","machine.scan_age_days","machine.root_group_id","machine.last_day_seen","machine.isolated","machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","machine.last_scanned_at","machine.group_name","machine.policy_id","machine.policy_name","machine.tags","machine.group_id","machine.id","machine.account_id","machine.online","machine.created_at","machine.job.status","machine.account.name","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.is_software_update_available","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.available_software_updates.sdk_version.new","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","protection_status","stats.assets.vulnerabilities_found","stats.assets.os_patches_available","stats.assets.last_scanned_at","stats.app_block_count","connected","agent.plugins.browser_phishing_protection.plugin_version"]}}}},"endpoints":{"type":"array","title":"Endpoints IDs","items":{"type":"object","title":"Explicit list of endpoints","required":["id","account_id"],"properties":{"id":{"type":"string","title":"ID of the endpoint (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account to which the endpoint belongs (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"List of queries to fetch endpoints","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing  a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan  before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.post.export"}},"/api/v2/rmm/endpoints/export/async":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["endpoints","groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["machine.is_deleted","machine.scan_age_days","machine.root_group_id","machine.last_day_seen","machine.isolated","machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","machine.last_scanned_at","machine.group_name","machine.policy_id","machine.policy_name","machine.tags","machine.group_id","machine.id","machine.account_id","machine.online","machine.created_at","machine.job.status","machine.account.name","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.is_software_update_available","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.available_software_updates.sdk_version.new","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","protection_status","stats.assets.vulnerabilities_found","stats.assets.os_patches_available","stats.assets.last_scanned_at","stats.app_block_count","connected","agent.plugins.browser_phishing_protection.plugin_version"]}}}},"endpoints":{"type":"array","title":"Endpoints IDs","items":{"type":"object","title":"Explicit list of endpoints","required":["id","account_id"],"properties":{"id":{"type":"string","title":"ID of the endpoint (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account to which the endpoint belongs (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"List of queries to fetch endpoints","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing  a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan  before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.post.export.async"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/agent_info":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Agent Info of Endpoint Body 200 Schema","additionalProperties":true,"properties":{"nics":{"type":"array","title":"NICs","additionalItems":true,"items":{"type":"object","title":"NICs items","additionalProperties":true,"properties":{"ips":{"type":"array","title":"IPs schema","default":[],"examples":[["10.151.110.219"]],"additionalItems":true,"items":{"type":"string","title":"IP"}},"description":{"type":"string","title":"Description","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"MAC address","examples":["000C29DD431E"]}}}},"os_info":{"type":"object","title":"OS info","default":{},"additionalProperties":true,"properties":{"os_type":{"type":"string","title":"OS type","examples":["Server"]},"os_version":{"type":"string","title":"OS version","examples":["10.0.14393"]},"os_platform":{"type":"string","title":"OS platform","examples":["Windows"]},"os_architecture":{"type":"string","title":"OS architecture","examples":["Amd64"]},"os_release_name":{"type":"string","title":"OS release name","examples":["Microsoft Windows Server 2016 Standard"]}}},"plugins":{"type":"array","title":"Plugins","default":[],"additionalItems":true,"items":{"type":"object","title":"Plugin items","default":{},"properties":{"product_name":{"type":"string","title":"Product name","examples":["Endpoint Detection and Response"]},"sdk_version":{"type":"string","title":"SDK version","examples":["3.7.1.2840"]},"plugin_version":{"type":"string","title":"Plugin version","examples":["1.2.0.289"]},"update_package_version":{"type":"string","title":"Update package version","examples":["3.1.4.1"]},"component_package_version":{"type":"string","title":"Component package version","examples":["1.0.545"]},"desktop_isolation":{"type":"string","title":"Desktop isolation","examples":["False"]},"network_isolation":{"type":"string","title":"Network isolation","examples":["False"]},"process_isolation":{"type":"string","title":"Process isolation"},"reboot_reasons":{"type":"integer","title":"Reboot reasons"},"medrnet_version":{"type":"string","title":"Medrnet version","examples":["1.13.0.0"]},"frcore_version":{"type":"string","title":"FR Core version","examples":["1.8.1.152"]},"alerts":{"type":"object","title":"Alerts","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}}},"host_name":{"type":"string","title":"Host name","examples":["CJR-2016-RDS-ESXi"]},"last_user":{"type":"string","title":"last user","examples":["ONEVIEW\\ovadmin"]},"domain_name":{"type":"string","title":"Domain name","examples":["nebula.qa"]},"policy_etag":{"type":"string","title":"Policy etag","examples":["943695dd5fb09047802c6ddbf87883bf"]},"engine_version":{"type":"string","title":"Engine version","examples":["1.2.0.778"]},"dhcp_scope_name":{"type":"string","title":"DHCP scope name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified host name","examples":["CJR-2016-RDS-ESXi.nebula.qa"]},"last_seen_at":{"type":"string","title":"last seen at","examples":["2020-04-24T20:02:37.989756Z"]},"agent_info_last_updated_at":{"type":"string","title":"Agent info last updated at","examples":["2020-04-24T19:04:20.600724Z"]},"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"source_location":{"type":"object","properties":{"city":{"type":"string"},"country":{"type":"string"},"country_iso":{"type":"string"},"continent":{"type":"string"},"accuracy_radius":{"type":"integer"},"point":{"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number"}]},"lon":{"allOf":[{"bignumber":true},{"type":"number"}]}}},"time_zone":{"type":"string"},"postal_code":{"type":"string"},"subdivisions":{"type":"array","items":{"type":"string"}},"anonymous_proxy":{"type":"boolean"}}}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.get.endpoint.id.agent_info"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/assets":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get assets of an endpoint","type":"object","properties":{"startups":{"type":"array","title":"Startup programs","items":{"type":"object","properties":{"key":{"title":"Key","type":"string"},"name":{"title":"Name","type":"string"},"value":{"title":"Value","type":["string","null"]}}}},"os_info":{"type":"object","title":"Operating System info","properties":{"os_platform":{"type":"string","title":"OS platform"},"os_architecture":{"type":"string","title":"OS architecture"},"os_version":{"type":"string","title":"OS version"},"os_release_name":{"type":"string","title":"OS release name"},"os_type":{"type":"string","title":"OS type"}}},"memory":{"type":["object","null"],"title":"Memory","properties":{"total_virtual":{"type":"number","title":"Total virtual space"},"free_virtual":{"type":"number","title":"Free virtual space"},"total_physical":{"type":"number","title":"Total physical space"},"free_physical":{"type":"number","title":"Free physical space"}}},"computer_info":{"type":"object","title":"Computer info","properties":{"manufacturer":{"type":"string","title":"Manufacturer"},"model":{"type":"string","title":"Model"}}},"software_installed":{"type":"array","title":"Software installed","items":{"type":"object","properties":{"vendor":{"type":"string","title":"Vendor"},"product":{"type":"string","title":"Product"},"installed_date":{"type":["string","null"],"title":"Installed at date"},"version":{"type":"string","title":"Version"}}}},"nics":{"type":"array","title":"NICs","items":{"type":"object","properties":{"mac_address":{"type":"string","title":"MAC address"},"description":{"type":"string","title":"Description"},"ips":{"type":"array","title":"IPs","items":{"type":"string"}}}}},"drives":{"type":["array","null"],"title":"Drives","items":{"type":"object","properties":{"freespace_available":{"type":"number","title":"Available free space"},"volume_label":{"type":"string","title":"Volume label"},"drive_format":{"type":"string","title":"Drive format"},"freespace_total":{"type":"number","title":"Total of space free"},"name":{"type":"string","title":"Name"},"encryption":{"type":"integer","title":"Encryption","description":"0 = not encrypted, 1 = encrypted, 2 = error, undefined = unknown"},"total_size":{"type":"number","title":"Total size"}}}},"updates_installed":{"type":"array","title":"Updates installed","items":{"type":"object","properties":{"installed_date":{"type":["string","null"],"title":"Installed at data"},"title":{"type":"string","title":"Title"}}}},"domain_name":{"type":["string","null"],"title":"Domain name"},"culture":{"type":"string","title":"Culture"},"object_sid":{"type":["string","null"],"title":"SID of object"},"dhcp_scope_name":{"type":"string","title":"DJCP scope name"},"time_zone":{"type":"string","title":"Timezone"},"host_name":{"type":"string","title":"Host name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified hostname"},"object_guid":{"type":["string","null"],"title":"GUID of object"},"plugin_version":{"type":"string","title":"Plugin version"}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.get.endpoint.id.assets"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/network":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get network information about an endpoint.","properties":{"nics":{"type":"array","title":"The Nics Schema","items":{"type":"object","title":"The Items Schema","properties":{"ips":{"type":"array","title":"The Ips Schema","items":{"type":"string","title":"The IP addresses"}},"description":{"type":"string","title":"The Description of the nics"},"mac_address":{"type":"string","title":"The Mac address"}}}},"host_name":{"type":"string","title":"Host name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified host name"},"last_seen_at":{"type":"string","title":"The last time the endpoint checked in as online (max 1 per hour) (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"agent_info_last_updated_at":{"type":"string","title":"Agent info last updated at (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.get.endpoint.id.network"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/sa":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"sort_field","required":false,"in":"query","description":"Sort field","schema":{"type":"string","enum":["timestamp","level","pc_hostname"]}},{"name":"sort_direction","required":false,"in":"query","description":"Sort direction","schema":{"type":"string","enum":["asc","desc"]}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"Since (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$"}},{"name":"per_page","required":false,"in":"query","description":"Items per page","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Suspicious activity of an endopint","required":["sa","total_count"],"properties":{"sa":{"type":"array","title":"Suspicious activity","items":{"type":"object","title":"Suspicious activity items","properties":{"detection_id_list":{"type":"array","title":"Suspicious activity IDs","items":{"type":"number"}},"status":{"type":"string","title":"Status"},"timestamp":{"type":"string","title":"Status"},"path":{"type":"string","title":"Path"},"pc_hostname":{"type":"string","title":"Hostname of endpoint"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"closed":{"type":"integer","title":"Closed"},"level":{"type":"integer","title":"Level"},"detected_by_count":{"type":"integer","title":"Count"}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.endpoint.id.sa"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/exclusions":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"Suspicious activity ID","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Exclusions for suspicious activity  by endpoint","required":["data"],"properties":{"data":{"type":"array","title":"Exclusions","items":{"type":"object","title":"Exclusion","properties":{"path":{"type":"string","title":"Path"},"md5":{"type":"string","title":"MD5"},"command_line":{"type":"string","title":"command_line"}}}}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.endpoint.id.sa.id.exclusion"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/remediate":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"Suspicious activity ID","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The eagle remediate schema","properties":{"job_id":{"type":["string","null"],"title":"ID of the remediation job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.endpoint.id.sa.sa_id.remediate"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/scans/{scan_id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Valid Account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"id","required":true,"in":"path","description":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"scan_id","required":true,"in":"path","description":"Scan ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate_schedule_name","required":false,"in":"query","description":"Populate the schedule name","schema":{"type":"boolean"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Scans By Id Body 200 Schema","type":"object","required":["id","machine_id","from_cloud","ondemand","scan_type","started_at","started_at_local","reported_at","duration_seconds","found_count","quarantined_count","deleted_count","total_count","metadata","machine_name","os_platform"],"additionalProperties":false,"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema(Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"schedule_id":{"type":["string","null"],"title":"The schedule_id Schema(Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"schedule_name":{"type":"string","title":"Schedule name (when populated)"},"from_cloud":{"type":"boolean","title":"The From_cloud Schema"},"ondemand":{"type":"boolean","title":"The Ondemand Schema"},"scan_type":{"type":"string","title":"The Scan_type Schema"},"started_at":{"type":"string","title":"The Started_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"started_at_local":{"type":"string","title":"The Started_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"duration_seconds":{"type":"integer","title":"The Duration_seconds Schema"},"found_count":{"type":"integer","title":"The Found_count Schema"},"quarantined_count":{"type":"integer","title":"The Quarantined_count Schema"},"deleted_count":{"type":"integer","title":"The Deleted_count Schema"},"total_count":{"type":"integer","title":"The Total_count Schema"},"metadata":{"type":"object","title":"The Metadata Schema","properties":{"id":{"type":"string","title":"The Id Schema"},"cpu":{"type":"string","title":"The Cpu Schema"},"foldersDetected":{"type":"integer","title":"The Foldersdetected Schema"},"componentsUpdatePackageVersion":{"type":"string","title":"The Componentsupdatepackageversion Schema"},"registryValuesDetected":{"type":"integer","title":"The Registryvaluesdetected Schema"},"schemaVersion":{"type":"integer","title":"The Schemaversion Schema"},"processesDetected":{"type":"integer","title":"The Processesdetected Schema"},"isUserAdmin":{"type":"boolean","title":"The Isuseradmin Schema"},"sourceDetails":{"type":"object","title":"The Sourcedetails Schema","properties":{"scanDurationSecs":{"type":"integer","title":"The Scandurationsecs Schema"},"scanOptions":{"type":"object","title":"The Scanoptions Schema","properties":{"scanMemoryObjects":{"type":"boolean","title":"The Scanmemoryobjects Schema"},"scanStartupAndRegistry":{"type":"boolean","title":"The Scanstartupandregistry Schema"},"scanRootKits":{"type":"boolean","title":"The Scanrootkits Schema"},"scanType":{"type":"string","title":"The Scantype Schema"},"scanPUMs":{"type":"boolean","title":"The Scanpums Schema"},"scanArchives":{"type":"boolean","title":"The Scanarchives Schema"},"scanFileSystem":{"type":"boolean","title":"The Scanfilesystem Schema"},"scanPUPs":{"type":"boolean","title":"The Scanpups Schema"},"useHeuristics":{"type":"boolean","title":"The Useheuristics Schema"}}},"objectsScanned":{"type":"integer","title":"The Objectsscanned Schema"},"scanResult":{"type":"string","title":"The Scanresult Schema"},"type":{"type":"string","title":"The Type Schema"}}},"fileSystem":{"type":"string","title":"The Filesystem Schema"},"dbSDKUpdatePackageVersion":{"type":"string","title":"The Dbsdkupdatepackageversion Schema"},"os":{"type":"string","title":"The Os Schema"},"detectionDateTime":{"type":"string","title":"The Detectiondatetime Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"modulesDetected":{"type":"integer","title":"The Modulesdetected Schema"},"licenseState":{"type":"string","title":"The Licensestate Schema"},"loggedOnUserName":{"type":"string","title":"The Loggedonusername Schema"},"filesDetected":{"type":"integer","title":"The Filesdetected Schema"},"registryKeysDetected":{"type":"integer","title":"The Registrykeysdetected Schema"},"applicationVersion":{"type":"string","title":"The Applicationversion Schema"}}},"machine_name":{"type":"string","title":"The Machine_name Schema"},"os_platform":{"type":"string","title":"The Os_platform Schema"},"devices":{"type":"object","title":"Device control related data"}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.get.endpoint.id.scans.id"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/scans":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$"}},{"name":"threats_detected","required":false,"in":"query","description":"Optional parameter to filter out scan results based on whether threats were found. If omitted defaults to returning all.","schema":{"type":"string","enum":["true","false",""]}},{"name":"start_index","required":false,"in":"query","description":"The start index for pagination","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","description":"The page size for pagination","schema":{"type":"string"}},{"name":"populate","required":false,"in":"query","schema":{"type":"string","pattern":"^schedules$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Scans Body 200 Schema","type":"array","items":{"type":"object","title":"The Items Schema","required":["id","deleted_count","duration_seconds","found_count","from_cloud","machine_id","machine_name","ondemand","os_platform","quarantined_count","reported_at","scan_type","started_at","started_at_local","total_count"],"additionalProperties":false,"properties":{"id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"deleted_count":{"type":"integer","title":"The Deleted_count Schema"},"duration_seconds":{"type":"integer","title":"The Duration_seconds Schema"},"found_count":{"type":"integer","title":"The Found_count Schema"},"from_cloud":{"type":"boolean","title":"The From_cloud Schema"},"machine_id":{"type":"string","title":"The Machine_id Schema"},"machine_name":{"type":"string","title":"The Machine_name Schema"},"ondemand":{"type":"boolean","title":"The Ondemand Schema"},"os_platform":{"type":"string","title":"The Os_platform Schema"},"quarantined_count":{"type":"integer","title":"The Quarantined_count Schema"},"reported_at":{"type":"string","title":"The Reported_at Schema"},"scan_type":{"type":"string","title":"The Scan_type Schema"},"started_at":{"type":"string","title":"The Started_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"started_at_local":{"type":"string","title":"The Started_at_local Schema"},"total_count":{"type":"integer","title":"The Total_count Schema"},"schedule_id":{"type":"string","title":"The schedule ID. Present only if the scan is triggered by a schedule"},"schedule_name":{"type":"string","title":"The schedule name. Present only if the scan is triggered by a schedule and populate=schedule is sent in the request"},"job_id":{"type":"string","title":"The Job ID. Present only if the scan is triggered by a job"}}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.get.endpoint.id.scans"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/scans/{scan_id}/detections":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":false,"in":"path","description":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"scan_id","required":false,"in":"path","description":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Scans By Id Detections Body 200 Schema","type":"object","required":["detections","total_count","next_cursor"],"properties":{"detections":{"type":"array","title":"The Threats Schema","items":{"type":"object","title":"The Items Schema","additionalProperties":true,"required":["id","scan_id","machine_id","machine_name","group_id","detection_id","scanned_at","scanned_at_local","reported_at","status","type","path","category","ip_address","url","port","affected_application","md5","process_name"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The Machine_name Schema"},"group_id":{"type":"string","title":"The Group_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The Detection_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scanned_at":{"type":"string","title":"The Scanned_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"The Scanned_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"The Status Schema"},"threat_name":{"type":"string","title":"The Threat_name Schema"},"type":{"type":"array","title":"The Type Schema","items":{"type":"string","title":"The Items Schema"}},"path":{"type":"string","title":"The Path Schema"},"category":{"type":"string","title":"The Category Schema"},"ip_address":{"type":"string","title":"The Ip_address Schema"},"url":{"type":"string","title":"The Url Schema","examples":["https://example.com"]},"port":{"type":"string","title":"The Port Schema"},"affected_application":{"type":"string","title":"The Affected_application Schema"},"md5":{"type":"string","title":"The Md5 Schema"},"process_name":{"type":"string","title":"The Process_name Schema"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.get.endpoint.id.scans.id.detections"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/status":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoint By Id Status Body 200 Schema","required":["remediation_required","reboot_required","suspicious_activity","isolation","scan_needed"],"properties":{"remediation_required":{"type":"object","title":"Whether this endpoint requires remediation","required":["status","infection_count"],"properties":{"status":{"type":"boolean","title":"True if it's infected"},"infection_count":{"type":"integer","title":"Number of threats detected"},"job_state":{"type":"integer","title":"State of the last job issued"}}},"reboot_required":{"type":"object","title":"The Reboot_required Schema","required":["status","reasons"],"properties":{"status":{"type":"boolean","title":"Status"},"reasons":{"type":"integer","title":"Reasons"},"job_id":{"type":"string","title":"Job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_state":{"title":"Job state","type":"integer"}}},"suspicious_activity":{"type":"object","title":"Suspicious activity","required":["status","count"],"properties":{"status":{"type":"boolean","title":"Status"},"count":{"type":"integer","title":"Count"}}},"isolation":{"type":"object","title":"Isolation","required":["status","process","network","desktop"],"properties":{"status":{"type":"boolean","title":"Status"},"process":{"type":"boolean","title":"Process"},"network":{"type":"boolean","title":"Network"},"desktop":{"type":"boolean","title":"Desktop"}}},"scan_needed":{"type":"object","title":"Scan needed","required":["status","job_state"],"properties":{"status":{"type":"boolean","title":"Status"},"job_state":{"type":["null","string"],"title":"Job state"},"last_scanned_at":{"type":"string","title":"Last time scanned at (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]}}}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.get.endpoint.id.status"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/diag-log":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get Diagnostic Logs Response","properties":{"url":{"type":"string","description":"The URL to download the diagnostic logs"}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.get.endpoint.id.diag-log"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/quarantine":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"name","required":false,"in":"query","description":"Search with quarantine threat name.","schema":{"type":"string"}},{"name":"category","required":false,"in":"query","description":"Search with quarantine category.","schema":{"type":"string"}},{"name":"type","required":false,"in":"query","description":"Search with quarantine type","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"Timestamp to filter since quarantine scan times.","schema":{"type":"string"}},{"name":"until","required":false,"in":"query","description":"Timestamp to filter until quarantine scan times.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The get quearantines response","description":"Get quarantine for a given machine","examples":[{"quarantined_threats":[{"id":"957fc464-9ee1-473c-8f49-d89d2da1d5d8","scan_id":"00000000-0000-0000-0000-000000000000","machine_id":"0ac6eb75-3b3d-49ea-86ea-4349465d32bf","machine_name":"EndpointDetections","group_id":"999a0d78-a983-44fc-a302-995cdfb39da3","detection_id":"1491ac5b-60fc-439c-acd3-4e5e1881337f","scanned_at":"2020-05-20T13:21:21Z","scanned_at_local":"2020-05-20T13:21:21Z","reported_at":"2020-05-20T13:21:23.114719Z","threat_name":"ransomware.script","type":["file"],"path":"C:\\Deploy\\RealTime\\ransomware.exe","category":"arw","ip_address":"","url":"","port":""}],"total_count":1,"next_cursor":""}],"required":["quarantined_threats","total_count","next_cursor"],"properties":{"quarantined_threats":{"type":"array","title":"List of quearantine threats","description":"List of quarantined threats.","examples":[[{"id":"957fc464-9ee1-473c-8f49-d89d2da1d5d8","scan_id":"00000000-0000-0000-0000-000000000000","machine_id":"0ac6eb75-3b3d-49ea-86ea-4349465d32bf","machine_name":"EndpointDetections","group_id":"999a0d78-a983-44fc-a302-995cdfb39da3","detection_id":"1491ac5b-60fc-439c-acd3-4e5e1881337f","scanned_at":"2020-05-20T13:21:21Z","scanned_at_local":"2020-05-20T13:21:21Z","reported_at":"2020-05-20T13:21:23.114719Z","threat_name":"ransomware.script","type":["file"],"path":"C:\\Deploy\\RealTime\\ransomware.exe","category":"arw","ip_address":"","url":"","port":""}]],"items":{"type":"object","title":"Get detection by id","additionalProperties":true,"required":["id","scan_id","machine_id","detection_id","scanned_at","scanned_at_local","reported_at","status","type","path","category"],"properties":{"id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"Scan ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"Endpoint ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"Machine name"},"group_id":{"type":"string","title":"Group ID the endpoint has (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_name":{"type":"string","title":"Group name the endpoint has"},"policy_id":{"type":"string","title":"The ID of the policy associated to the machine where this detection happened (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"policy_name":{"type":"string","title":"Policy name"},"detection_id":{"type":"string","title":"Detection id from endpoint"},"scanned_at":{"type":"string","title":"Scanned at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"Scanned at local time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"Detection reported at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"Status"},"action_taken":{"type":"string","title":"Action Taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"threat_name":{"type":"string","title":"Threat name"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Items"}},"path":{"type":"string","title":"Path"},"category":{"type":"string","title":"Category"},"ip_address":{"type":"string","title":"IP address"},"url":{"type":"string","title":"Url"},"port":{"type":"string","title":"Port"},"affected_application":{"type":"string","title":"Affected application"},"md5":{"type":"string","title":"Md5"},"process_name":{"type":"string","title":"Process name"},"auto_removal_at":{"type":["string","null"],"title":"Automatic removal timestamp","description":"When the quarantined item will be automatically removed.","format":"date-time","examples":["2020-03-23T17:23:17.860482Z"]}}}},"total_count":{"type":"integer","title":"Total count of items","description":"Total count of items","default":0,"examples":[1]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.get.quarantine"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/close":{"put":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"Suspicious activity ID","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.get.endpoint.id.sa.sa_id.close"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/open":{"put":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"Suspicious activity ID","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.get.endpoint.id.sa.sa_id.open"}},"/api/v2/rmm/accounts/{account_id}/endpoints/{id}/tags":{"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["endpoints.performActions"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Set endpoint tags","required":["alias"],"properties":{"alias":{"type":"string","title":"Alias name for the machine. Empty string to remove the alias"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search endpoints","required":["created_at","resource_id","tags"],"properties":{"created_at":{"type":"string","title":"When the alias was created"},"updated_at":{"type":"string","title":"When the alias was created"},"resource_id":{"type":"string","title":"Unique identifier for this resource"},"tags":{"type":"object","title":"Tags object","properties":{"alias":{"type":"string","title":"alias"}}}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.nebula.rmm.endpoint.id.tags"}},"/api/v2/rmm/accounts/{account_id}/endpoints":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"incident":["read_nebula_data","caching"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search accounts endpoints request","properties":{"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing  a reboot"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match)"},"alias":{"type":"string","title":"Aliases for the machine"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name"},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name"},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name"},"engine_version.keyword":{"type":"string","title":"Filter the search by engine version"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name"},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"sort_field":{"type":"string","title":"Specify the field to use for sorting","enum":["group_id","group_name","at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","policy_name","policy_id","last_day_seen","name_multi_search","serial_number","machine_ip"]},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"default_group":{"type":"boolean","title":"Specify if endpoint is in default group"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","serial_number","machine_ip"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search accounts endpoints response","required":["endpoints","total_count","next_cursor"],"properties":{"aggregations":{"type":"object","additionalProperties":true},"endpoints":{"type":"array","title":"Endpoints","items":{"type":"object","title":"Endpoint items","additionalProperties":true,"properties":{"link":{"type":"string","title":"Link"},"protection_status":{"type":"string","title":"Protection Status"},"display_name":{"type":"string","title":"Display Name"},"agent":{"type":"object","title":"Agent","additionalProperties":true,"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"last_user":{"type":"string","title":"The last user logging in"},"at":{"type":"string","title":"Agent reported At"},"machine_id":{"type":"string","title":"Machine ID"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"nics":{"type":"array","title":"Nics","items":{"type":"object","title":"Nics items","properties":{"ips":{"type":"array","title":"Collection of IPs","items":{"type":"string","title":"IP"}},"description":{"type":"string","title":"Description"},"mac_address":{"type":"string","title":"Mac address"}}}},"os_info":{"type":"object","title":"Os info","properties":{"os_type":{"type":"string","title":"Os type"},"os_version":{"type":"string","title":"Os version"},"os_platform":{"type":"string","title":"Os platform"},"os_architecture":{"type":"string","title":"Os architecture"},"os_release_name":{"type":"string","title":"Os release name"}}},"domain_name":{"type":"string","title":"Domain name"},"host_name":{"type":"string","title":"Host name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified host name"},"plugins":{"type":"object","title":"Plugins","properties":{"incident_response":{"type":"object","title":"Incident response","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"update_package_version":{"type":"string","title":"Update package version"},"component_package_version":{"type":"string","title":"Component package version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"asset_manager":{"type":"object","title":"Asset manager","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_protection":{"type":"object","title":"Endpoint protection plugin","properties":{"sdk_version":{"type":"string","title":"SDK version plugin"},"product_name":{"type":"string","title":"Name of the product"},"plugin_version":{"type":"string","title":"Version of the product"},"update_package_version":{"type":"string","title":"Update version"},"component_package_version":{"type":"string","title":"Component version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_detection_and_response":{"type":"object","title":"Endpoint detection and response","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}}}},"engine_version":{"type":"string","title":"Engine version"},"policy_etag":{"type":"string","title":"Policy etag"},"version":{"type":"integer","title":"Version"},"document_id":{"type":"string","title":"Document ID"},"machine_ip":{"type":"string","title":"Machine public IP"},"source_location":{"type":"object","properties":{"city":{"type":"string"},"country":{"type":"string"},"country_iso":{"type":"string"},"continent":{"type":"string"},"accuracy_radius":{"type":"integer"},"point":{"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number"}]},"lon":{"allOf":[{"bignumber":true},{"type":"number"}]}}},"time_zone":{"type":"string"},"postal_code":{"type":"string"},"subdivisions":{"type":"array","items":{"type":"string"}},"anonymous_proxy":{"type":"boolean"}}}}},"machine":{"type":"object","title":"Endpoint","additionalProperties":true,"properties":{"id":{"type":"string","title":"ID"},"job":{"type":"object","title":"Last job","additionalProperties":true},"account":{"type":"object","title":"Last job","additionalProperties":true},"online":{"type":"boolean","title":"Online"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"root_group_id":{"type":"string","title":"Root group ID"},"group_name":{"type":"string","title":"Group name"},"policy_id":{"type":"string","title":"Policy ID"},"policy_name":{"type":"string","title":"Policy name"},"last_day_seen":{"type":"string","title":"Last day seen"},"last_active":{"type":"string","title":"Last time the endpoint connected to Nebula in real time"},"isolated":{"type":"boolean","title":"Is isolated"},"scan_age_days":{"type":"integer","title":"Days from last scan"},"suspicious_activity_count":{"type":"integer","title":"Count of suspicious activities"},"infection_count":{"type":"integer","title":"Count of infections"},"reboot_required":{"type":"integer","title":"Is reboot required"},"last_scanned_at":{"type":"string","title":"Last scanned at"},"is_deleted":{"type":"boolean","title":"Is deleted"},"version":{"type":"integer","title":"Version"},"is_default_group":{"type":"boolean","title":"Default group (only when populated)"},"document_id":{"type":"string","title":"Document ID"}}},"machineVersion":{"type":"integer","title":"Machine version"}}}},"total_count":{"type":"integer","title":"Count"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"after":{"type":"string","title":"After cursor"}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.v2.rmm.search.account.endpoints"}},"/api/v2/rmm/endpoints/search-groupby":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoints Search GroupBy Request Schema","required":["group_by","page_size","account_ids"],"allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"machine_id":{"type":"string","title":"Filter the search to the endpoints with specified id"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"alerts.codes":{"type":"string","title":"Alert codes"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search to the endpoints with wildcard EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"default_group":{"type":"boolean","title":"Specify whether the group is default"},"app_block":{"type":"boolean","title":"Specify the number of app block activity"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","object_guid","serial_number"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["1970-01-01T00:00:00Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan  before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"app_block_count_after":{"type":"string","title":"Specify after which date to start app block activity count (Only when populate: {app_block: true} is set) (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"group_by":{"type":"string","title":"The sort field Schema","enum":["os_info.os_platform","os_info.os_type","os_info.os_architecture","os_info.os_version","os_info.os_release_name","engine_version","policy_etag","account_id","group_id","root_group_id","policy_id","machine_ip","last_user","object_guid","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","serial_number","protection_status","plugins.browser_phishing_protection.plugin_version"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000},"account_cardinality":{"type":"boolean","title":"If specified, the number of accounts associated with each result value is displayed (works only with specific groupby-s). When grouping by engine_platform, grouping by os_platform is added by default"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoints Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":["object","string"],"title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"name":{"type":"string","title":"The Total Schema"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Endpoints"],"operationId":"api.rmm.search.endpoints.group"}},"/api/v2/rmm/accounts/{account_id}/webhooks/subscriptions":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.createOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Post Schema","required":["url","enabled","events"],"properties":{"url":{"type":"string","title":"The URL where you want to receive the webhook notification (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"Description for this subscription"},"enabled":{"type":"boolean","title":"Whether this subscription is enabled or not"},"events":{"type":"array","title":"The Events you want to subscribe to","minItems":1,"items":{"type":"string","title":"The Items Schema","enum":["all","detection","job_status_change","machine_events","threat_events","agent_events","quarantine_events","edr_events","syslog_events","exclusion_events","scheduled_events","policy_events","user_events","drive_events","cve_events","dns_events","license_events","appblock_events","endpoint_events"]}},"custom_headers":{"type":"array","title":"Custom headers you want to receive","items":{"type":"object","title":"The Items Schema","required":["key","value"],"properties":{"key":{"type":"string","title":"The key of the header","examples":["authorization"]},"value":{"type":"string","title":"The value of the header"}}}},"max_retries":{"type":"integer","title":"The max number of times the webhooks should retry upon failures","default":10,"exclusiveMinimum":0,"maximum":10},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Post Response Schema","required":["id","url","enabled","events"],"properties":{"id":{"type":"string","title":"The unique identifier for this subscription (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"The URL where you want to receive the webhook notification (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"The Description for this subscription"},"enabled":{"type":"boolean","title":"Whether this subscription is enabled or not"},"events":{"type":"array","title":"The Events you want to subscribe to","minItems":1,"items":{"type":"string","title":"Event","enum":["detection","job_status_change"]}},"custom_headers":{"type":"array","title":"Custom headers you want to receive","items":{"type":"object","title":"Items","required":["key","value"],"properties":{"key":{"type":"string","title":"The key of the header","examples":["authorization"]},"value":{"type":"string","title":"The value of the header"}}}},"max_retries":{"type":"integer","title":"The maximum number of times the webhooks should retry upon failures","default":10,"exclusiveMinimum":0,"maximum":10},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}}}}},"tags":["V2 (RMM) Webhooks"],"operationId":"api.v2.rmm.post.webhooks.subscriptions"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["notifications.viewOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Webhooks' subscriptions","required":["records","next_cursor"],"properties":{"records":{"type":"array","title":"Subscription records","items":{"type":"object","title":"List items","required":["id","url","enabled","events"],"properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"Url (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"Description"},"enabled":{"type":"boolean","title":"Enabled"},"events":{"type":"array","title":"Events","items":{"type":"string","title":"Event Items"}},"custom_headers":{"type":"array","title":"Custom headers","items":{"type":"object","title":"Custom headers items","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key","examples":["authorization"]},"value":{"type":"string","title":"The header value"}}}},"max_retries":{"type":"integer","title":"Maximum number of retries event payload is sent to webhook without receiving success response."},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Webhooks"],"operationId":"api.v2.rmm.webhooks.subscriptions.get"}},"/api/v2/rmm/accounts/{account_id}/webhooks/subscriptions/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.deleteOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Webhooks"],"operationId":"api.v2.rmm.post.webhooks.subscriptions.delete"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["notifications.viewOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Get Id Schema","required":["id","url","enabled","events"],"properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"Url of the webhook (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"Description of the webhook"},"enabled":{"type":"boolean","title":"Webhook is enabled"},"events":{"type":"array","title":"List of events webhook starts to receive.","items":{"type":"string","title":"The Items Schema"}},"custom_headers":{"type":"array","title":"Custom headers","items":{"type":"object","title":"Custom headers items","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key","examples":["authorization"]},"value":{"type":"string","title":"The header value"}}}},"max_retries":{"type":"integer","title":"Maximum number of retries event payload is sent to webhook without receiving success response.","default":10},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}}}}},"tags":["V2 (RMM) Webhooks"],"operationId":"api.v2.rmm.webhooks.subscriptions.get.id"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.editOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Add webhook","required":["url","enabled","events"],"properties":{"url":{"type":"string","title":"Url of the webhook (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"Description of the webhook"},"enabled":{"type":"boolean","title":"Webhook is enabled"},"events":{"type":"array","title":"List of events webhook starts to receive.","items":{"type":"string","title":"List items","enum":["all","detection","job_status_change","machine_events","threat_events","agent_events","quarantine_events","edr_events","syslog_events","exclusion_events","scheduled_events","policy_events","user_events","drive_events","cve_events","dns_events","license_events","appblock_events","endpoint_events"]}},"custom_headers":{"type":"array","title":"Custom headers","items":{"type":"object","title":"Custom headers items","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key","examples":["authorization"]},"value":{"type":"string","title":"The header value"}}}},"max_retries":{"type":"integer","title":"Maximum number of retries event payload is sent to webhook without receiving success response.","default":10},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Update webhook","properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"URL of the webhook (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"Description of the webhook"},"enabled":{"type":"boolean","title":"Webhook is enabled"},"events":{"type":"array","title":"List of events webhook starts to receive.","items":{"type":"string","title":"List items"}},"custom_headers":{"type":"array","title":"Custom headers","items":{"type":"object","title":"Custom headers items","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key","examples":["authorization"]},"value":{"type":"string","title":"The header value"}}}},"max_retries":{"type":"integer","title":"Maximum number of retries event payload is sent to webhook without receiving success response.","default":10},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}}}}},"tags":["V2 (RMM) Webhooks"],"operationId":"api.v2.rmm.post.webhooks.subscriptions.update"}},"/api/v2/rmm/accounts/{account_id}/installers":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["endpoints.install"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get all installers for a managed nebula account","properties":{"win_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"x64_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"win_web":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"win_full":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"mac_os":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"ea2_arm_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"ea2_x64_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"ea2_x86_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"ea2_legacy_x64_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"ea2_legacy_x86_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}}}}}}}},"tags":["V2 (RMM) Installers"],"operationId":"api.rmm.get.installers"}},"/api/v2/rmm/accounts/{account_id}/events":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["events.view","activityLogs.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"search_string","required":false,"in":"query","description":"Search with events with event string.","schema":{"type":"string"}},{"name":"machine_id","required":false,"in":"query","description":"Search with machine_id","schema":{"type":"string"}},{"name":"start","required":false,"in":"query","description":"Timestamp to filter since event times.","schema":{"type":"string"}},{"name":"end","required":false,"in":"query","description":"Timestamp to filter until event times.","schema":{"type":"string"}},{"name":"severity_flags","required":false,"in":"query","description":"Filter with severity flag","schema":{"type":"number","enum":[0,1,2,4,8]}},{"name":"source","required":false,"in":"query","description":"Filter by event source","schema":{"type":"number","enum":[1,2,3,4,5,6]}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Collection of events","required":["events","total_count","next_cursor"],"properties":{"events":{"type":"array","title":"List of events","items":{"type":"object","additionalProperties":true,"title":"Event","properties":{"id":{"type":"string","title":"ID"},"machine_id":{"type":"string","title":"Endpoint ID"},"user_id":{"type":"string","title":"User ID"},"source":{"type":["integer","string"],"title":"Source"},"source_name":{"type":"string","title":"Source name"},"type":{"type":["integer","string"],"title":"Type"},"type_name":{"type":"string","title":"Type name"},"friendly_type":{"type":"string","title":"Friendly name of type"},"severity":{"type":["integer","string"],"title":"Severity"},"severity_name":{"type":"string","title":"Severity name"},"details":{"type":["object","array"],"additionalProperties":true,"title":"Details","properties":{"message":{"type":"string","title":"Message"},"filename":{"type":"string","title":"Filename"},"name":{"type":"string","title":"Name"},"user_email":{"type":"string","title":"User email"},"user_name":{"type":"string","title":"User name"},"user_role":{"type":"string","title":"User role"}}},"timestamp":{"type":"string","title":"Timestamp","examples":["2020-03-10T00:00:18.247444Z"]}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Events"],"operationId":"api.rmm.get.events"}},"/api/v2/rmm/accounts/{account_id}/policies/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["policies.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.delete.policy"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate","required":false,"in":"query","schema":{"type":"string","pattern":"^(groups|exclusions)([,](groups|exclusions))*$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.get.policy.id"},"put":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Put Policy Request","required":["name","contents","etag"],"properties":{"contents":{"type":"object","additionalProperties":true,"title":"Policy contents","properties":{"policy":{"type":"object","additionalProperties":true,"title":"Policy","examples":[{"startup_options":{"timeout":"60000","toggle_on":true},"sirius_update_schedule":"FREQ=DAILY","updates":{"pause_until":"2020-04-10T14:55:00+03:00"},"endpoint_interface_options":{"allow_run_threat_scan":true,"show_threat_scan_shortcuts":true,"limit_endpoint_agent_control":true,"show_tray_icon":"true","show_windows_contextmenu":true,"display_rtp_events":true},"endpoint_tamper_protection":{"uninstall_password":"$2a$10$EPD4LGvmr7zGoh7wXb9iUe.l5bikO/UzeayibCu1q/tFNT22ePQOK"},"protect_service":true}],"properties":{"updates":{"type":"object","additionalProperties":true,"title":"Software Updates","examples":[{"pause_until":"2020-04-10T14:55:00+03:00"}],"properties":{"pause_until":{"type":["string","null"],"title":"While paused, prevents ThreatDown software from updating (Windows Only)","examples":["2020-04-10T14:55:00+03:00"]}}},"protect_service":{"type":"boolean","title":"Prevents ThreatDown services and processes from being stopped (Windows 10 only)","examples":[true]},"startup_options":{"type":"object","additionalProperties":true,"title":"Allow services additional time to start","examples":[{"timeout":"60000","toggle_on":true}],"properties":{"timeout":{"type":["integer","string"],"title":"Adjust the timeout period for all services, milliseconds. Max 10min.","examples":[60000]},"toggle_on":{"type":"boolean","title":"Provide all services with additional time to initiate","examples":[false]}}},"sirius_update_schedule":{"type":"string","title":"How often agent should be updated","examples":["FREQ=DAILY"]},"endpoint_interface_options":{"type":"object","additionalProperties":true,"title":"Endpoint interface options","examples":[{"show_windows_contextmenu":true,"display_rtp_events":true,"allow_run_threat_scan":true,"show_threat_scan_shortcuts":true,"limit_endpoint_agent_control":true,"show_tray_icon":"true"}],"properties":{"show_tray_icon":{"type":["string","boolean"],"title":"Show Malwarebytes icon in notification area","examples":["true"]},"display_rtp_events":{"type":"boolean","title":"Display real-time protection notifications","examples":[true]},"allow_run_threat_scan":{"type":"boolean","title":"Allow users to run a Threat Scan (all threats will be quarantined automatically)","examples":[true]},"show_windows_contextmenu":{"type":"boolean","title":"Show ThreatDown option in context menus (Windows only)","examples":[true]},"show_threat_scan_shortcuts":{"type":"boolean","title":"Show ThreatDown shortcuts on Start menu and desktop to run Threat Scans (Windows only)","examples":[true]},"limit_endpoint_agent_control":{"type":"boolean","title":"The Limit_endpoint_agent_control Schema","description":"Allow only Administrator level users to interact with the ThreatDown Tray (Windows only, not supported in XP or Server 2003)","examples":[true]}}},"endpoint_tamper_protection":{"type":["object","null"],"additionalProperties":true,"title":"Tamper protection","examples":[{"uninstall_password":"$2a$10$EPD4LGvmr7zGoh7wXb9iUe.l5bikO/UzeayibCu1q/tFNT22ePQOK"}],"properties":{"uninstall_password":{"type":"string","title":"Encrypted password","examples":[""]}}}}},"status":{"type":"string","title":"Status of the Policy","examples":["ok"]},"packages":{"type":"array","title":"Collection of packages","default":[],"items":{"type":"object","additionalProperties":true,"title":"Packages contain Policies for different products","examples":[{"sirius_os_packages":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.assetmanager"}],"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_installs":true,"include_processes":false,"include_memory":true,"include_modules":false,"include_updates":true,"include_drives":true,"include_startups":true}},"product_name":"Asset Manager","schema_version":"1.0"},{"enabled":true,"sirius_os_packages":[{"sirius_package_name":"epa.win.plugin.edr","operating_system":"windows"}],"policy":{"isolation":{"enabled":true,"title_image_path":"https://nebula-retina-mb-qa.eng-dev.mb-internal.com/api/v1/machine/isolation_image/20200310_105756.bmp?amazonaws=1","text":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","title":"Malware or suspicious application behavior has been detected on this computer."},"log_file_retention_rules":{"max_num_roll_backups":5,"max_file_size":"125MB"},"flight_recorder":{"learning_duration":20,"very_aggressive":true,"enabled_server":true,"rollback":{"window":48,"enabled":true,"file_size":"20MB","backup_quota":30,"file_size_server":"100MB","backup_folder_server":"C:\\ProgramData\\Malwarebytes Endpoint Agent\\Plugins\\EDRPlugin\\Backup\\"},"enabled":true,"eagle_url":""},"policy_version":1},"product_name":"Endpoint Detection and Response","schema_version":"1.0"},{"sirius_os_packages":[{"operating_system":"mac","sirius_package_name":"epa.mac.plugin.assetmanager"}],"policy":{"policy_version":1,"default_scan_settings":{"include_startups":true,"include_nics":true,"include_installs":true,"include_processes":false,"include_memory":true,"include_modules":false,"include_updates":true,"include_drives":true}},"product_name":"Mac Asset Manager","schema_version":"1.0"},{"policy":{"isolation":{"enabled":false},"policy_version":1,"flight_recorder":{"enabled":false,"eagle_url":"","enabled_server":false,"learning_duration":20,"network_collection_enabled":false},"log_file_retention_rules":{"max_file_size":"125MB","max_file_size_server":"1024MB","max_num_roll_backups":5}},"enabled":false,"product_name":"Mac Endpoint Detection and Response","schema_version":"1.0","sirius_os_packages":[{"operating_system":"mac","sirius_package_name":"epa.mac.plugin.edr"}]},{"enabled":true,"policy_version":1,"schema_version":"1.0","sirius_os_packages":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.mbam"}],"policy":{"self_protect_early_start":true,"usage_stat":true,"application_updates":true,"windows_context_menus":false,"protection_aging":"180","win_ac":"default","rtp_settings":{"ransomware":{"enabled":true},"delay_rtp":true,"exploit":{"enabled":true,"options":{"amp_sp_other":true,"java_wmcl":true,"java_aijoip":true,"amp_crg32_media":true,"abp_pmbp_media":true,"amp_mrad_pdf":true,"amp_mrad_browser":true,"amp_sp_pdf":true,"ah_bua_ms":true,"amp_mph_chrome":true,"ah_bua_pdf":true,"ah_ahs_chrome":true,"java_misp":true,"ah_daef_browser":true,"ah_dep_chrome":true,"amp_depb_ms":true,"amp_rrg64_browser":true,"amp_crg32_other":true,"amp_rrg32_media":true,"amp_crg64_media":true,"abp_pmbp_other":true,"abp_mll_media":true,"amp_mph_pdf":true,"amp_mrad_media":true,"amp_rrg32_ms":true,"ah_bua_browser":true,"amp_rrg32_browser":true,"java_mosp":true,"amp_mph_media":true,"ah_dahs_browser":true,"amp_rrg32_other":true,"abp_pmbp_pdf":true,"amp_crg64_other":true,"abp_mll_other":true,"abp_pmbp_browser":true,"amp_rrg64_media":true,"amp_mrad_other":true,"amp_crg32_pdf":true,"amp_depb_media":true,"amp_rrg64_chrome":true,"amp_crg64_pdf":true,"abp_mll_pdf":true,"ah_bua_chrome":true,"amp_depb_pdf":true,"java_mmgp":true,"amp_rrg32_chrome":true,"ah_dep_ms":true,"abp_powmi_ms":true,"amp_depb_chrome":true,"amp_mph_other":false,"abp_mll_chrome":true,"amp_crg64_chrome":true,"amp_mph_ms":true,"abp_povba_ms":true,"amp_sp_chrome":true,"abp_piev_browser":true,"ah_ahs_media":true,"amp_crg32_chrome":true,"ah_dep_media":true,"ah_ahs_pdf":false,"amp_crg64_ms":true,"abp_mll_ms":true,"amp_rrg64_other":true,"amp_depb_browser":true,"amp_depb_other":true,"amp_mrad_chrome":true,"ah_bua_media":false,"amp_mph_browser":true,"abp_pmbp_chrome":true,"java_mmcep":true,"abp_mll_browser":true,"amp_crg64_browser":true,"amp_sp_ms":true,"ah_ahs_browser":true,"ah_ahs_other":true,"ah_dep_other":true,"amp_sp_browser":true,"ah_bua_other":true,"amp_rrg32_pdf":true,"ah_ahs_ms":true,"amp_rrg64_pdf":true,"amp_crg32_browser":true,"ah_diev_browser":true,"amp_sp_media":true,"amp_rrg64_ms":true,"ah_dep_pdf":true,"ah_dep_browser":true,"amp_mrad_ms":true,"abp_pmbp_ms":true,"amp_crg32_ms":true},"protected":[{"application":"Adobe Acrobat","default":true,"enabled":true,"file":"acrobat.exe","type":"FamilyPdfReader"},{"application":"Adobe Reader","default":true,"enabled":true,"file":"acrord32.exe","type":"FamilyPdfReader"},{"application":"Comodo Dragon","default":true,"enabled":true,"file":"dragon.exe","type":"FamilyWebBrowser"},{"type":"FamilyWebBrowser","application":"Cyberfox","default":true,"enabled":true,"file":"cyberfox.exe"},{"default":true,"enabled":true,"file":"Foxit PhantomPDF.exe","type":"FamilyPdfReader","application":"Foxit Phantom"},{"type":"FamilyPdfReader","application":"Foxit Phantom","default":true,"enabled":true,"file":"FoxitPhantomPDF.exe"},{"application":"Foxit Reader","default":true,"enabled":true,"file":"foxit reader.exe","type":"FamilyPdfReader"},{"default":true,"enabled":true,"file":"icedragon.exe","type":"FamilyWebBrowser","application":"IceDragon"},{"enabled":true,"file":"iexplore.exe","type":"FamilyWebBrowser","application":"Internet Explorer (and add-ons)","default":true},{"enabled":true,"file":"java.exe","type":"FamilyJava","application":"Java","default":true},{"default":true,"enabled":true,"file":"javaw.exe","type":"FamilyJava","application":"Java"},{"default":true,"enabled":true,"file":"javaws.exe","type":"FamilyJava","application":"Java"},{"application":"LibreOffice","default":true,"enabled":true,"file":"soffice.bin","type":"FamilyOffice"},{"application":"Maxthon","default":true,"enabled":true,"file":"maxthon.exe","type":"FamilyWebBrowser"},{"enabled":true,"file":"MicrosoftEdge.exe","type":"FamilyWebBrowser","application":"Microsoft Edge (and add-ons)","default":true},{"application":"Microsoft Office Excel","default":true,"enabled":true,"file":"excel.exe","type":"FamilyOffice"},{"default":true,"enabled":true,"file":"powerpnt.exe","type":"FamilyOffice","application":"Microsoft Office PowerPoint"},{"type":"FamilyOffice","application":"Microsoft Office Publisher","default":true,"enabled":true,"file":"mspub.exe"},{"type":"FamilyOffice","application":"Microsoft Office Word","default":true,"enabled":true,"file":"winword.exe"},{"type":"FamilyWebBrowser","application":"Mozilla Firefox (and add-ons)","default":true,"enabled":true,"file":"firefox.exe"},{"enabled":true,"file":"opera.exe","type":"FamilyWebBrowser","application":"Opera (and plug-ins)","default":true},{"enabled":true,"file":"palemoon.exe","type":"FamilyWebBrowser","application":"Palemoon","default":true},{"application":"QuickTime Player","default":true,"enabled":true,"file":"quicktimeplayer.exe","type":"FamilyMultimedia"},{"enabled":true,"file":"seamonkey.exe","type":"FamilyWebBrowser","application":"Seamonkey","default":true},{"enabled":true,"file":"tor.exe","type":"FamilyWebBrowser","application":"Tor Browser","default":true},{"enabled":true,"file":"vlc.exe","type":"FamilyMultimedia","application":"VLC Player","default":true},{"type":"FamilyWebBrowser","application":"Waterfox","default":true,"enabled":true,"file":"waterfox.exe"},{"application":"Winamp Player","default":true,"enabled":true,"file":"winamp.exe","type":"FamilyMultimedia"},{"type":"FamilyMultimedia","application":"Windows Media Player (mplayer2)","default":true,"enabled":true,"file":"mplayer2.exe"},{"default":true,"enabled":true,"file":"wmplayer.exe","type":"FamilyMultimedia","application":"Windows Media Player (wmplayer)"}]},"malware":{"enabled":true},"web":{"enabled":true},"display_rtp_notifications":true,"delay_seconds":"30"},"protection_update_enabled":true,"auto_service_updates":true,"self_protection":true,"default_scan_settings":{"no_reboot":false,"no_archive":false,"reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","enable_shuriken":true,"ark":true,"scan_priority":"low","reboot_delay_rrule":"FREQ=HOURLY;INTERVAL=2;COUNT=1","pup_detection":"Detect","allow_postpone_reboot":true,"reboot_delay":60,"pum_detection":"Detect"},"install_settings":{"start_menu":true,"program_folder":null,"desktop_shortcut":true},"protection_update_schedule":"FREQ=HOURLY;INTERVAL=2","monitoring_options":{"enabled":false}},"product_name":"Endpoint Protection"},{"policy":{"policy_version":1,"rtp_settings":{"app_block":{"enabled":true},"malware":{"enabled":true}},"default_scan_settings":{"reboot_delay_rrule":"FREQ=HOURLY;INTERVAL=2;COUNT=1","no_reboot":false,"pup_detection":"Detect","allow_postpone_reboot":true,"reboot_message":"In order to completely quarantine the detected threat(s),your computer must be restarted."}},"product_name":"Mac Endpoint Protection","schema_version":"1.0","enabled":true,"sirius_os_packages":[{"sirius_package_name":"epa.mac.plugin.epp","operating_system":"mac"}]},{"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_drives":false,"include_memory":false,"include_installs":true,"include_startups":true}},"enabled":true,"product_name":"Chrome OS Asset Manager","schema_version":"1.0","sirius_os_packages":[{"operating_system":"chromeos","sirius_package_name":"epa.chromeos.plugin.assetmanager"}]},{"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_drives":true,"include_memory":true,"include_installs":false,"include_startups":false}},"enabled":true,"product_name":"Linux Asset Manager","schema_version":"1.0","sirius_os_packages":[{"operating_system":"linux","sirius_package_name":"epa.linux.plugin.assetmanager"}]},{"policy":{"action":"BLOCK","policy_version":1,"minutes_to_block":5,"protected_protocols":[{"name":"FTP","ports":[21],"enabled":false},{"name":"RDP","ports":[],"enabled":false}],"allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5},"enabled":false,"product_name":"Windows Remote Intrusion Detection and Prevention","schema_version":"1.0","sirius_os_packages":[{"min_os_version":"6.1","operating_system":"windows","sirius_package_name":"epa.win.plugin.bfp"}]},{"policy":{"rtp_settings":{"malware":{"enabled":true}},"policy_version":1},"enabled":true,"product_name":"Linux Endpoint Protection","schema_version":"1.0","sirius_os_packages":[{"operating_system":"linux","sirius_package_name":"epa.linux.plugin.epp"}]},{"policy":{"rtp_settings":{"web":{"enabled":true},"malware":{"enabled":true},"ransomware":{"enabled":true}},"policy_version":1,"default_scan_settings":{"scan_after_reboot":false,"scan_after_update":true},"protection_update_schedule":"FREQ=HOURLY;INTERVAL=1"},"enabled":true,"product_name":"Chrome OS Endpoint Protection","schema_version":"1.0","sirius_os_packages":[{"operating_system":"chromeos","sirius_package_name":"epa.chromeos.plugin.epp"}]}],"properties":{"policy":{"type":"object","additionalProperties":true,"title":"Policy for a product, see examples of Policies for different products.","properties":{"protected_protocols":{"type":"array","additionalProperties":true,"title":"Protected Protocols","examples":[{"name":"RDP","ports":[3389],"enabled":true}],"items":{"type":"object","additionalProperties":true,"title":"Items of protected protocols.","properties":{"name":{"type":"string","title":"Protocol Name","examples":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"],"enum":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"]},"ports":{"type":"array","title":"Protected Protocol Ports","description":"1-65535","examples":[[3389,1433,21]],"items":{"type":"integer","minimum":1,"maximum":65535}},"enabled":{"title":"Enable Protected Protocol","type":"boolean","default":false,"examples":[true,false]}}}}}},"product_name":{"type":"string","title":"Name of the product","examples":["Asset Manager"]},"schema_version":{"type":"string","title":"Version of the schema","examples":["1.0"]},"sirius_os_packages":{"type":"array","title":"Defines the package and OS for updates.","items":{"type":"object","additionalProperties":true,"title":"Items of OS packages.","examples":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.assetmanager"}],"properties":{"operating_system":{"type":"string","title":"Specify operating system","examples":["windows"]},"sirius_package_name":{"type":"string","title":"Package name","examples":["epa.win.plugin.assetmanager"]}}}}}}},"schema_version":{"type":"string","title":"Version of the Policy schema","examples":["1.0"]}}},"name":{"type":"string","title":"The name for this policy"},"etag":{"type":"string","title":"Etag of this policy","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property."},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.put.policy"}},"/api/v2/rmm/accounts/{account_id}/policies/{id}/isolation_image":{"delete":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.delete.policy.isolation_image.id"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Response of isolation image request","properties":{"url":{"type":"string","title":"Url of the isolation image attached to the policy"}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.get.policy.isolation_image.id"},"post":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.post.policy.isolation_image.id"}},"/api/v2/rmm/accounts/{account_id}/policies/{id}/expire-endpoints":{"delete":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.delete.policy.expire"},"put":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Put Policy Request","required":["expire_duration"],"properties":{"expire_duration":{"type":"number","title":"Number of days after which to expire endpoints and remove from the console","minimum":1,"maximum":365}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.put.policy.expire"}},"/api/v2/rmm/accounts/{account_id}/policies":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response of policies","required":["policies","total_count"],"properties":{"policies":{"type":"array","title":"Collection of policies","items":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}},"total_count":{"type":"integer","title":"Count of policies"}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.get.get.policy"},"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create policy","required":["name","contents"],"additionalProperties":true,"properties":{"name":{"type":"string","title":"Name for this policy"},"contents":{"type":"object","additionalProperties":true,"title":"Policy contents","properties":{"policy":{"type":"object","additionalProperties":true,"title":"Policy","examples":[{"startup_options":{"timeout":"60000","toggle_on":true},"sirius_update_schedule":"FREQ=DAILY","updates":{"pause_until":"2020-04-10T14:55:00+03:00"},"endpoint_interface_options":{"allow_run_threat_scan":true,"show_threat_scan_shortcuts":true,"limit_endpoint_agent_control":true,"show_tray_icon":"true","show_windows_contextmenu":true,"display_rtp_events":true},"endpoint_tamper_protection":{"uninstall_password":"$2a$10$EPD4LGvmr7zGoh7wXb9iUe.l5bikO/UzeayibCu1q/tFNT22ePQOK"},"protect_service":true}],"properties":{"updates":{"type":"object","additionalProperties":true,"title":"Software Updates","examples":[{"pause_until":"2020-04-10T14:55:00+03:00"}],"properties":{"pause_until":{"type":["string","null"],"title":"While paused, prevents ThreatDown software from updating (Windows Only)","examples":["2020-04-10T14:55:00+03:00"]}}},"protect_service":{"type":"boolean","title":"Prevents ThreatDown services and processes from being stopped (Windows 10 only)","examples":[true]},"startup_options":{"type":"object","additionalProperties":true,"title":"Allow services additional time to start","examples":[{"timeout":"60000","toggle_on":true}],"properties":{"timeout":{"type":["integer","string"],"title":"Adjust the timeout period for all services, milliseconds. Max 10min.","examples":[60000]},"toggle_on":{"type":"boolean","title":"Provide all services with additional time to initiate","examples":[false]}}},"sirius_update_schedule":{"type":"string","title":"How often agent should be updated","examples":["FREQ=DAILY"]},"endpoint_interface_options":{"type":"object","additionalProperties":true,"title":"Endpoint interface options","examples":[{"show_windows_contextmenu":true,"display_rtp_events":true,"allow_run_threat_scan":true,"show_threat_scan_shortcuts":true,"limit_endpoint_agent_control":true,"show_tray_icon":"true"}],"properties":{"show_tray_icon":{"type":["string","boolean"],"title":"Show Malwarebytes icon in notification area","examples":["true"]},"display_rtp_events":{"type":"boolean","title":"Display real-time protection notifications","examples":[true]},"allow_run_threat_scan":{"type":"boolean","title":"Allow users to run a Threat Scan (all threats will be quarantined automatically)","examples":[true]},"show_windows_contextmenu":{"type":"boolean","title":"Show ThreatDown option in context menus (Windows only)","examples":[true]},"show_threat_scan_shortcuts":{"type":"boolean","title":"Show ThreatDown shortcuts on Start menu and desktop to run Threat Scans (Windows only)","examples":[true]},"limit_endpoint_agent_control":{"type":"boolean","title":"The Limit_endpoint_agent_control Schema","description":"Allow only Administrator level users to interact with the ThreatDown Tray (Windows only, not supported in XP or Server 2003)","examples":[true]}}},"endpoint_tamper_protection":{"type":["object","null"],"additionalProperties":true,"title":"Tamper protection","examples":[{"uninstall_password":"$2a$10$EPD4LGvmr7zGoh7wXb9iUe.l5bikO/UzeayibCu1q/tFNT22ePQOK"}],"properties":{"uninstall_password":{"type":"string","title":"Encrypted password","examples":[""]}}}}},"status":{"type":"string","title":"Status of the Policy","examples":["ok"]},"packages":{"type":"array","title":"Collection of packages","default":[],"items":{"type":"object","additionalProperties":true,"title":"Packages contain Policies for different products","examples":[{"sirius_os_packages":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.assetmanager"}],"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_installs":true,"include_processes":false,"include_memory":true,"include_modules":false,"include_updates":true,"include_drives":true,"include_startups":true}},"product_name":"Asset Manager","schema_version":"1.0"},{"enabled":true,"sirius_os_packages":[{"sirius_package_name":"epa.win.plugin.edr","operating_system":"windows"}],"policy":{"isolation":{"enabled":true,"title_image_path":"https://nebula-retina-mb-qa.eng-dev.mb-internal.com/api/v1/machine/isolation_image/20200310_105756.bmp?amazonaws=1","text":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","title":"Malware or suspicious application behavior has been detected on this computer."},"log_file_retention_rules":{"max_num_roll_backups":5,"max_file_size":"125MB"},"flight_recorder":{"learning_duration":20,"very_aggressive":true,"enabled_server":true,"rollback":{"window":48,"enabled":true,"file_size":"20MB","backup_quota":30,"file_size_server":"100MB","backup_folder_server":"C:\\ProgramData\\Malwarebytes Endpoint Agent\\Plugins\\EDRPlugin\\Backup\\"},"enabled":true,"eagle_url":""},"policy_version":1},"product_name":"Endpoint Detection and Response","schema_version":"1.0"},{"sirius_os_packages":[{"operating_system":"mac","sirius_package_name":"epa.mac.plugin.assetmanager"}],"policy":{"policy_version":1,"default_scan_settings":{"include_startups":true,"include_nics":true,"include_installs":true,"include_processes":false,"include_memory":true,"include_modules":false,"include_updates":true,"include_drives":true}},"product_name":"Mac Asset Manager","schema_version":"1.0"},{"policy":{"isolation":{"enabled":false},"policy_version":1,"flight_recorder":{"enabled":false,"eagle_url":"","enabled_server":false,"learning_duration":20,"network_collection_enabled":false},"log_file_retention_rules":{"max_file_size":"125MB","max_file_size_server":"1024MB","max_num_roll_backups":5}},"enabled":false,"product_name":"Mac Endpoint Detection and Response","schema_version":"1.0","sirius_os_packages":[{"operating_system":"mac","sirius_package_name":"epa.mac.plugin.edr"}]},{"enabled":true,"policy_version":1,"schema_version":"1.0","sirius_os_packages":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.mbam"}],"policy":{"self_protect_early_start":true,"usage_stat":true,"application_updates":true,"windows_context_menus":false,"protection_aging":"180","win_ac":"default","rtp_settings":{"ransomware":{"enabled":true},"delay_rtp":true,"exploit":{"enabled":true,"options":{"amp_sp_other":true,"java_wmcl":true,"java_aijoip":true,"amp_crg32_media":true,"abp_pmbp_media":true,"amp_mrad_pdf":true,"amp_mrad_browser":true,"amp_sp_pdf":true,"ah_bua_ms":true,"amp_mph_chrome":true,"ah_bua_pdf":true,"ah_ahs_chrome":true,"java_misp":true,"ah_daef_browser":true,"ah_dep_chrome":true,"amp_depb_ms":true,"amp_rrg64_browser":true,"amp_crg32_other":true,"amp_rrg32_media":true,"amp_crg64_media":true,"abp_pmbp_other":true,"abp_mll_media":true,"amp_mph_pdf":true,"amp_mrad_media":true,"amp_rrg32_ms":true,"ah_bua_browser":true,"amp_rrg32_browser":true,"java_mosp":true,"amp_mph_media":true,"ah_dahs_browser":true,"amp_rrg32_other":true,"abp_pmbp_pdf":true,"amp_crg64_other":true,"abp_mll_other":true,"abp_pmbp_browser":true,"amp_rrg64_media":true,"amp_mrad_other":true,"amp_crg32_pdf":true,"amp_depb_media":true,"amp_rrg64_chrome":true,"amp_crg64_pdf":true,"abp_mll_pdf":true,"ah_bua_chrome":true,"amp_depb_pdf":true,"java_mmgp":true,"amp_rrg32_chrome":true,"ah_dep_ms":true,"abp_powmi_ms":true,"amp_depb_chrome":true,"amp_mph_other":false,"abp_mll_chrome":true,"amp_crg64_chrome":true,"amp_mph_ms":true,"abp_povba_ms":true,"amp_sp_chrome":true,"abp_piev_browser":true,"ah_ahs_media":true,"amp_crg32_chrome":true,"ah_dep_media":true,"ah_ahs_pdf":false,"amp_crg64_ms":true,"abp_mll_ms":true,"amp_rrg64_other":true,"amp_depb_browser":true,"amp_depb_other":true,"amp_mrad_chrome":true,"ah_bua_media":false,"amp_mph_browser":true,"abp_pmbp_chrome":true,"java_mmcep":true,"abp_mll_browser":true,"amp_crg64_browser":true,"amp_sp_ms":true,"ah_ahs_browser":true,"ah_ahs_other":true,"ah_dep_other":true,"amp_sp_browser":true,"ah_bua_other":true,"amp_rrg32_pdf":true,"ah_ahs_ms":true,"amp_rrg64_pdf":true,"amp_crg32_browser":true,"ah_diev_browser":true,"amp_sp_media":true,"amp_rrg64_ms":true,"ah_dep_pdf":true,"ah_dep_browser":true,"amp_mrad_ms":true,"abp_pmbp_ms":true,"amp_crg32_ms":true},"protected":[{"application":"Adobe Acrobat","default":true,"enabled":true,"file":"acrobat.exe","type":"FamilyPdfReader"},{"application":"Adobe Reader","default":true,"enabled":true,"file":"acrord32.exe","type":"FamilyPdfReader"},{"application":"Comodo Dragon","default":true,"enabled":true,"file":"dragon.exe","type":"FamilyWebBrowser"},{"type":"FamilyWebBrowser","application":"Cyberfox","default":true,"enabled":true,"file":"cyberfox.exe"},{"default":true,"enabled":true,"file":"Foxit PhantomPDF.exe","type":"FamilyPdfReader","application":"Foxit Phantom"},{"type":"FamilyPdfReader","application":"Foxit Phantom","default":true,"enabled":true,"file":"FoxitPhantomPDF.exe"},{"application":"Foxit Reader","default":true,"enabled":true,"file":"foxit reader.exe","type":"FamilyPdfReader"},{"default":true,"enabled":true,"file":"icedragon.exe","type":"FamilyWebBrowser","application":"IceDragon"},{"enabled":true,"file":"iexplore.exe","type":"FamilyWebBrowser","application":"Internet Explorer (and add-ons)","default":true},{"enabled":true,"file":"java.exe","type":"FamilyJava","application":"Java","default":true},{"default":true,"enabled":true,"file":"javaw.exe","type":"FamilyJava","application":"Java"},{"default":true,"enabled":true,"file":"javaws.exe","type":"FamilyJava","application":"Java"},{"application":"LibreOffice","default":true,"enabled":true,"file":"soffice.bin","type":"FamilyOffice"},{"application":"Maxthon","default":true,"enabled":true,"file":"maxthon.exe","type":"FamilyWebBrowser"},{"enabled":true,"file":"MicrosoftEdge.exe","type":"FamilyWebBrowser","application":"Microsoft Edge (and add-ons)","default":true},{"application":"Microsoft Office Excel","default":true,"enabled":true,"file":"excel.exe","type":"FamilyOffice"},{"default":true,"enabled":true,"file":"powerpnt.exe","type":"FamilyOffice","application":"Microsoft Office PowerPoint"},{"type":"FamilyOffice","application":"Microsoft Office Publisher","default":true,"enabled":true,"file":"mspub.exe"},{"type":"FamilyOffice","application":"Microsoft Office Word","default":true,"enabled":true,"file":"winword.exe"},{"type":"FamilyWebBrowser","application":"Mozilla Firefox (and add-ons)","default":true,"enabled":true,"file":"firefox.exe"},{"enabled":true,"file":"opera.exe","type":"FamilyWebBrowser","application":"Opera (and plug-ins)","default":true},{"enabled":true,"file":"palemoon.exe","type":"FamilyWebBrowser","application":"Palemoon","default":true},{"application":"QuickTime Player","default":true,"enabled":true,"file":"quicktimeplayer.exe","type":"FamilyMultimedia"},{"enabled":true,"file":"seamonkey.exe","type":"FamilyWebBrowser","application":"Seamonkey","default":true},{"enabled":true,"file":"tor.exe","type":"FamilyWebBrowser","application":"Tor Browser","default":true},{"enabled":true,"file":"vlc.exe","type":"FamilyMultimedia","application":"VLC Player","default":true},{"type":"FamilyWebBrowser","application":"Waterfox","default":true,"enabled":true,"file":"waterfox.exe"},{"application":"Winamp Player","default":true,"enabled":true,"file":"winamp.exe","type":"FamilyMultimedia"},{"type":"FamilyMultimedia","application":"Windows Media Player (mplayer2)","default":true,"enabled":true,"file":"mplayer2.exe"},{"default":true,"enabled":true,"file":"wmplayer.exe","type":"FamilyMultimedia","application":"Windows Media Player (wmplayer)"}]},"malware":{"enabled":true},"web":{"enabled":true},"display_rtp_notifications":true,"delay_seconds":"30"},"protection_update_enabled":true,"auto_service_updates":true,"self_protection":true,"default_scan_settings":{"no_reboot":false,"no_archive":false,"reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","enable_shuriken":true,"ark":true,"scan_priority":"low","reboot_delay_rrule":"FREQ=HOURLY;INTERVAL=2;COUNT=1","pup_detection":"Detect","allow_postpone_reboot":true,"reboot_delay":60,"pum_detection":"Detect"},"install_settings":{"start_menu":true,"program_folder":null,"desktop_shortcut":true},"protection_update_schedule":"FREQ=HOURLY;INTERVAL=2","monitoring_options":{"enabled":false}},"product_name":"Endpoint Protection"},{"policy":{"policy_version":1,"rtp_settings":{"app_block":{"enabled":true},"malware":{"enabled":true}},"default_scan_settings":{"reboot_delay_rrule":"FREQ=HOURLY;INTERVAL=2;COUNT=1","no_reboot":false,"pup_detection":"Detect","allow_postpone_reboot":true,"reboot_message":"In order to completely quarantine the detected threat(s),your computer must be restarted."}},"product_name":"Mac Endpoint Protection","schema_version":"1.0","enabled":true,"sirius_os_packages":[{"sirius_package_name":"epa.mac.plugin.epp","operating_system":"mac"}]},{"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_drives":false,"include_memory":false,"include_installs":true,"include_startups":true}},"enabled":true,"product_name":"Chrome OS Asset Manager","schema_version":"1.0","sirius_os_packages":[{"operating_system":"chromeos","sirius_package_name":"epa.chromeos.plugin.assetmanager"}]},{"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_drives":true,"include_memory":true,"include_installs":false,"include_startups":false}},"enabled":true,"product_name":"Linux Asset Manager","schema_version":"1.0","sirius_os_packages":[{"operating_system":"linux","sirius_package_name":"epa.linux.plugin.assetmanager"}]},{"policy":{"action":"BLOCK","policy_version":1,"minutes_to_block":5,"protected_protocols":[{"name":"FTP","ports":[21],"enabled":false},{"name":"RDP","ports":[],"enabled":false}],"allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5},"enabled":false,"product_name":"Windows Remote Intrusion Detection and Prevention","schema_version":"1.0","sirius_os_packages":[{"min_os_version":"6.1","operating_system":"windows","sirius_package_name":"epa.win.plugin.bfp"}]},{"policy":{"rtp_settings":{"malware":{"enabled":true}},"policy_version":1},"enabled":true,"product_name":"Linux Endpoint Protection","schema_version":"1.0","sirius_os_packages":[{"operating_system":"linux","sirius_package_name":"epa.linux.plugin.epp"}]},{"policy":{"rtp_settings":{"web":{"enabled":true},"malware":{"enabled":true},"ransomware":{"enabled":true}},"policy_version":1,"default_scan_settings":{"scan_after_reboot":false,"scan_after_update":true},"protection_update_schedule":"FREQ=HOURLY;INTERVAL=1"},"enabled":true,"product_name":"Chrome OS Endpoint Protection","schema_version":"1.0","sirius_os_packages":[{"operating_system":"chromeos","sirius_package_name":"epa.chromeos.plugin.epp"}]}],"properties":{"policy":{"type":"object","additionalProperties":true,"title":"Policy for a product, see examples of Policies for different products.","properties":{"protected_protocols":{"type":"array","additionalProperties":true,"title":"Protected Protocols","examples":[{"name":"RDP","ports":[3389],"enabled":true}],"items":{"type":"object","additionalProperties":true,"title":"Items of protected protocols.","properties":{"name":{"type":"string","title":"Protocol Name","examples":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"],"enum":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"]},"ports":{"type":"array","title":"Protected Protocol Ports","description":"1-65535","examples":[[3389,1433,21]],"items":{"type":"integer","minimum":1,"maximum":65535}},"enabled":{"title":"Enable Protected Protocol","type":"boolean","default":false,"examples":[true,false]}}}}}},"product_name":{"type":"string","title":"Name of the product","examples":["Asset Manager"]},"schema_version":{"type":"string","title":"Version of the schema","examples":["1.0"]},"sirius_os_packages":{"type":"array","title":"Defines the package and OS for updates.","items":{"type":"object","additionalProperties":true,"title":"Items of OS packages.","examples":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.assetmanager"}],"properties":{"operating_system":{"type":"string","title":"Specify operating system","examples":["windows"]},"sirius_package_name":{"type":"string","title":"Package name","examples":["epa.win.plugin.assetmanager"]}}}}}}},"schema_version":{"type":"string","title":"Version of the Policy schema","examples":["1.0"]}}},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.post.policy"}},"/api/v2/rmm/accounts/{account_id}/policies/{id}/auto_isolation":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"policy auto-isolation settings","description":"Set policy expire endpoints payload specification","type":"object","properties":{"host_type":{"type":"integer","description":"Bitmask representing 'workstation (1)' and 'servers (2)'. Use 3 for all the host_types (1+2=3)","enum":[0,1,2,3]},"platform":{"type":"integer","description":"Bitmask representing 'windows (1)', 'macOS (2)', 'linux (4)'. Use 7 for all the platforms (1+2+4=7)","enum":[0,1,2,3,4,5,6,7]},"isolation_type":{"type":"object","properties":{"network":{"type":"boolean"},"process":{"type":"boolean"},"desktop":{"type":"boolean"}},"required":["network","process","desktop"],"anyOf":[{"properties":{"network":{"const":true}}},{"properties":{"process":{"const":true}}},{"properties":{"desktop":{"const":true}}}]}},"required":["host_type","platform","isolation_type"]}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.get.policy.auto_isolation"},"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"policy auto-isolation settings","description":"Set policy expire endpoints payload specification","type":"object","properties":{"host_type":{"type":"integer","description":"Bitmask representing 'workstation (1)' and 'servers (2)'. Use 3 for all the host_types (1+2=3)","enum":[0,1,2,3]},"platform":{"type":"integer","description":"Bitmask representing 'windows (1)', 'macOS (2)', 'linux (4)'. Use 7 for all the platforms (1+2+4=7)","enum":[0,1,2,3,4,5,6,7]},"isolation_type":{"type":"object","properties":{"network":{"type":"boolean"},"process":{"type":"boolean"},"desktop":{"type":"boolean"}},"required":["network","process","desktop"],"anyOf":[{"properties":{"network":{"const":true}}},{"properties":{"process":{"const":true}}},{"properties":{"desktop":{"const":true}}}]}},"required":["host_type","platform","isolation_type"]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"policy auto-isolation settings","description":"Set policy expire endpoints payload specification","type":"object","properties":{"host_type":{"type":"integer","description":"Bitmask representing 'workstation (1)' and 'servers (2)'. Use 3 for all the host_types (1+2=3)","enum":[0,1,2,3]},"platform":{"type":"integer","description":"Bitmask representing 'windows (1)', 'macOS (2)', 'linux (4)'. Use 7 for all the platforms (1+2+4=7)","enum":[0,1,2,3,4,5,6,7]},"isolation_type":{"type":"object","properties":{"network":{"type":"boolean"},"process":{"type":"boolean"},"desktop":{"type":"boolean"}},"required":["network","process","desktop"],"anyOf":[{"properties":{"network":{"const":true}}},{"properties":{"process":{"const":true}}},{"properties":{"desktop":{"const":true}}}]}},"required":["host_type","platform","isolation_type"]}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.post.policy.auto_isolation"}},"/api/v2/rmm/accounts/{account_id}/policies/{id}/secret":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tamperProtection.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Response of policy tamper protection secret","properties":{"secret":{"type":"string","title":"Secret of policy tamper protection"}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.get.policy.secret.id"},"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["tamperProtection.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Change Secret","required":["secret"],"properties":{"secret":{"type":"string","title":"New tamper protection secret for the policy"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Response of policy tamper protection secret","properties":{"secret":{"type":"string","title":"Secret of policy tamper protection"}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.post.policy.secret.id"}},"/api/v2/rmm/accounts/{account_id}/policies/system_default":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.get.policy.system_default"}},"/api/v2/rmm/accounts/{account_id}/policies/{source_id}/clone":{"post":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["policies.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"source_id","required":true,"in":"path","description":"ID of the policy to be cloned (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Clone policy","allOf":[{"type":"object","title":"Clone policy","required":["name"],"properties":{"name":{"type":"string","title":"Name for the cloned policy."},"include_policy_exclusions":{"type":"boolean","title":"Set to true for including exclusions. Defaults to false.","default":false}}},{"properties":{"destination_account_id":{"type":"string","title":"Destination Account ID. If omitted, the policy will be cloned in the same account"}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.post.policy.clone"}},"/api/v2/rmm/accounts/policies":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get policies for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"populate":{"type":"object","properties":{"dns_rules":{"type":"boolean","title":"Whether to populate dns rules"},"firewall_policies":{"type":"boolean","title":"Whether to populate firewall policies"}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response of policies","required":["policies","total_count"],"properties":{"policies":{"type":"array","title":"Collection of policies","items":{"allOf":[{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}},{"properties":{"default_for_accounts":{"type":"array","title":"If is_default=true, default_for_accounts is the list of accounts for which it is default","items":{"type":"string","title":"account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}},"total_count":{"type":"integer","title":"Count of policies"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.v2.rmm.search.policies"}},"/api/v2/rmm/accounts/{account_id}/policies/{id}/promote":{"put":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["V2 (RMM) Policies"],"operationId":"api.rmm.put.policy.promote"}},"/api/v2/rmm/accounts/{account_id}/exclusions/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["exclusions.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.delete.exclusions"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate_risk","required":false,"in":"query","description":"Populate risk fields on exclusion","schema":{"type":"boolean"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}}}}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.get.exclusions.id"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["exclusions.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Save Exclusion","additionalProperties":true,"required":["etag","type","value","enabled","exclude_from","account_level"],"properties":{"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line, 17: Exclusion for ransomware network protection","examples":[1,2,3,4,5,6,7,8,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policy_ids":{"type":"array","title":"IDs of Policies","default":[],"items":{"type":"string","title":"ID of the Policy"}}},"allOf":[{"if":{"properties":{"type":{"const":13}}},"then":{"properties":{"value":{"pattern":"^[a-fA-F0-9]{32}$"}}}},{"if":{"properties":{"enabled":{"const":true}}},"then":{"errorMessage":"should have at least one exclude_from property set to true","anyOf":[{"properties":{"exclude_from":{"properties":{"exploit_protection":{"const":true}},"required":["exploit_protection"]}}},{"properties":{"exclude_from":{"properties":{"malware_protection":{"const":true}},"required":["malware_protection"]}}},{"properties":{"exclude_from":{"properties":{"ransomware_protection":{"const":true}},"required":["ransomware_protection"]}}},{"properties":{"exclude_from":{"properties":{"website_protection":{"const":true}},"required":["website_protection"]}}},{"properties":{"exclude_from":{"properties":{"suspicious_activity":{"const":true}},"required":["suspicious_activity"]}}},{"properties":{"exclude_from":{"properties":{"bruteforce_protection":{"const":true}},"required":["bruteforce_protection"]}}}]}}],"errorMessage":{"if":"if enabled is true"}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}}}}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.put.exclusions"}},"/api/v2/rmm/accounts/{account_id}/gpo.global.exclusions/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["exclusions.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.delete.gpo.global.exclusions"}},"/api/v2/rmm/accounts/{account_id}/evaluates":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Evaluate exclusion body","required":["values"],"properties":{"values":{"type":"array","title":"Exclusion values to evaluate","minItems":1,"items":{"type":"string","title":"Exclusion value to evaluate","minLength":1}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Evaluate exclusion result","type":"object","additionalProperties":{"type":"object","required":["is_high_risk","risk_level","type_string","type_id","friendly_name","description","pattern"],"properties":{"is_high_risk":{"type":"boolean"},"risk_level":{"type":"string"},"type_string":{"type":"string"},"type_id":{"type":"integer"},"friendly_name":{"type":"string"},"description":{"type":"string"},"pattern":{"type":"string"}}}}}}}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.get.exclusions.evaluates"}},"/api/v2/rmm/accounts/{account_id}/exclusions":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"search_string","required":false,"in":"query","description":"Search with exclusion string.","schema":{"type":"string"}},{"name":"policy_ids","required":false,"in":"query","description":"Search with exclusion policy ids.","schema":{"type":"string"}},{"name":"type","required":false,"in":"query","description":"Search with exclusion type","schema":{"type":"number"}},{"name":"since","required":false,"in":"query","description":"Timestamp to filter since exclusion times.","schema":{"type":"string"}},{"name":"until","required":false,"in":"query","description":"Timestamp to filter until exclusion times.","schema":{"type":"string"}},{"name":"sort_by","required":false,"in":"query","description":"Field to sort results with. 'risk' is resolved in-memory by Retina (risk is not persisted).","schema":{"type":"string","enum":["enabled","value","created_at","updated_at","created_by","updated_by","type","risk"]}},{"name":"sort_order","required":false,"in":"query","description":"Sorting direction","schema":{"type":"string","enum":["asc","desc"]}},{"name":"populate_risk","required":false,"in":"query","description":"Populate risk fields on exclusions","schema":{"type":"boolean"}},{"name":"risk","required":false,"in":"query","description":"Filter exclusions by risk level (validated by Retina)","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get exclusions by account","type":"object","required":["exclusions","total_count","next_cursor"],"properties":{"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.get.exclusions"},"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["exclusions.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create Exclusion","additionalProperties":true,"required":["type","value","enabled","exclude_from","account_level"],"properties":{"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line, 17: Exclusion for ransomware network protection","examples":[1,2,3,4,5,6,7,8,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policy_ids":{"type":"array","title":"IDs of Policies","default":[],"items":{"type":"string","title":"ID of the Policy"}}},"allOf":[{"if":{"properties":{"type":{"const":13}}},"then":{"properties":{"value":{"pattern":"^[a-fA-F0-9]{32}$"}}}},{"if":{"properties":{"enabled":{"const":true}}},"then":{"errorMessage":"should have at least one exclude_from property set to true","anyOf":[{"properties":{"exclude_from":{"properties":{"exploit_protection":{"const":true}},"required":["exploit_protection"]}}},{"properties":{"exclude_from":{"properties":{"malware_protection":{"const":true}},"required":["malware_protection"]}}},{"properties":{"exclude_from":{"properties":{"ransomware_protection":{"const":true}},"required":["ransomware_protection"]}}},{"properties":{"exclude_from":{"properties":{"website_protection":{"const":true}},"required":["website_protection"]}}},{"properties":{"exclude_from":{"properties":{"suspicious_activity":{"const":true}},"required":["suspicious_activity"]}}},{"properties":{"exclude_from":{"properties":{"bruteforce_protection":{"const":true}},"required":["bruteforce_protection"]}}}]}}],"errorMessage":{"if":"if enabled is true"}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}}}}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.post.exclusions"}},"/api/v2/rmm/accounts/{account_id}/gpo.global.exclusions":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get GPO global exclusion","type":"object","properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"deleted_at":{"type":["string","null"],"title":"Deleted at"},"option_name":{"type":"string","enum":["gpo.global.exclusions"],"title":"Option name"},"option_value":{"type":"string","enum":["enabled","disabled"],"title":"Option value"},"table_id":{"type":"string","title":"table ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"table_name":{"type":"string","title":"Table name"}}}}}}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.get.gpo.global.exclusions"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["exclusions.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get GPO global exclusion","type":"object","properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"deleted_at":{"type":["string","null"],"title":"Deleted at"},"option_name":{"type":"string","enum":["gpo.global.exclusions"],"title":"Option name"},"option_value":{"type":"string","enum":["enabled","disabled"],"title":"Option value"},"table_id":{"type":"string","title":"table ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"table_name":{"type":"string","title":"Table name"}}}}}}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.put.gpo.global.exclusions"}},"/api/v2/rmm/accounts/gpo.global.exclusions":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search exclusions across multiple accounts","allOf":[{"type":"object","title":"Get exclusions for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"include_parent":{"title":"Include parent account's exclusions","description":"if true, the result will include the exclusions in the parent accounts, but only the exclusions that affect at least one of the account specified in account_ids (i.e. excluding the exclusions related only with policies of child accounts not specified in account_ids)","type":"boolean","default":false},"populate_risk":{"title":"Add the exclusion risk evaluation","description":"if true, add the risk evaluation for each exclusion.","type":"boolean","default":false},"sort_by":{"type":"string","title":"The field to sort by","enum":["created_at","updated_at"]},"sort_order":{"type":"string","title":"The order to sort by","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}},{"properties":{"types":{"title":"Exclusion types to search for","items":{"type":"number"}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get GPO PUM exclusions by account","type":"object","patternProperties":{"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$":{"type":"boolean"}},"examples":[{"5526034b-7967-4253-a5d9-260663e4fa4f":true,"9256034b-7967-4253-a5d9-260663e4fa4f":false}]}}}}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.post.gpo.global.exclusions"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["exclusions.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Bulk modify GPO PUM option on given accounts","required":["account_ids","value"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"value":{"type":"string","title":"The GPO PUM option value","enum":["enabled","disabled"]}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.put.gpo.global.exclusions.bulk"}},"/api/v2/rmm/accounts/exclusions":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search exclusions across multiple accounts","allOf":[{"type":"object","title":"Get exclusions for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"include_parent":{"title":"Include parent account's exclusions","description":"if true, the result will include the exclusions in the parent accounts, but only the exclusions that affect at least one of the account specified in account_ids (i.e. excluding the exclusions related only with policies of child accounts not specified in account_ids)","type":"boolean","default":false},"populate_risk":{"title":"Add the exclusion risk evaluation","description":"if true, add the risk evaluation for each exclusion.","type":"boolean","default":false},"sort_by":{"type":"string","title":"The field to sort by","enum":["created_at","updated_at"]},"sort_order":{"type":"string","title":"The order to sort by","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}},{"properties":{"types":{"title":"Exclusion types to search for","items":{"type":"number"}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get exclusions by account","type":"object","required":["exclusions","total_count","next_cursor"],"properties":{"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.v2.rmm.search.exclusions"}},"/api/v2/rmm/accounts/exclusions-risk-stats":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get exclusions risk stats for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"types":{"type":"array","title":"Optional list of exclusion type IDs to include in the risk stats. When omitted the count spans every type.","items":{"type":"integer","enum":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Exclusions risk stats","type":"object","required":["total_count","low","medium","high"],"properties":{"total_count":{"type":"integer"},"low":{"type":"integer"},"medium":{"type":"integer"},"high":{"type":"integer"}}}}}}},"tags":["V2 (RMM) Exclusions"],"operationId":"api.rmm.post.exclusions.risk-stats"}},"/api/v2/rmm/accounts/{account_id}/groups/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["groups.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Groups"],"operationId":"api.rmm.delete.groups"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["groups.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}}}}},"tags":["V2 (RMM) Groups"],"operationId":"api.rmm.getbyid.groups"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["groups.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Group Save","description":"Payload for creating a group","required":["name","policy_id"],"properties":{"name":{"type":"string","title":"Name"},"policy_id":{"type":"string","title":"Policy Id","examples":["575ec9d1-9ade-4a2b-98cd-d6b5e5ea63d7"]},"parent_id":{"type":"string","title":"Parent Id","description":"Id of parent group."},"schedule_ids":{"type":"array","title":"Schedule IDs this group should be assigned to","description":"Schedule IDs this group should be assigned to","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The schedule ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}}}}},"tags":["V2 (RMM) Groups"],"operationId":"api.rmm.put.groups"}},"/api/v2/rmm/accounts/{account_id}/groups":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["groups.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"name","required":false,"in":"query","description":"Filter by group name","schema":{"type":"string"}},{"name":"parent_id","required":false,"in":"query","description":"For filtering by parent group ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"filter_by_parent_id","required":false,"in":"query","description":"Set this to 'true' when parent_id has been set.","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Collection of groups","required":["groups","total_count","next_cursor"],"properties":{"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Groups"],"operationId":"api.rmm.get.groups"},"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["groups.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Group Save","description":"Payload for creating a group","required":["name","policy_id"],"properties":{"name":{"type":"string","title":"Name"},"policy_id":{"type":"string","title":"Policy Id","examples":["575ec9d1-9ade-4a2b-98cd-d6b5e5ea63d7"]},"parent_id":{"type":"string","title":"Parent Id","description":"Id of parent group."},"schedule_ids":{"type":"array","title":"Schedule IDs this group should be assigned to","description":"Schedule IDs this group should be assigned to","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The schedule ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}}}}},"tags":["V2 (RMM) Groups"],"operationId":"api.rmm.post.groups"}},"/api/v2/rmm/accounts/groups":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["groups.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Filter groups for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"name":{"type":"string","title":"Filter by group name"},"parent_id":{"type":"string","title":"For filtering by parent group ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"filter_by_parent_id":{"type":"string","title":"Set this to 'true' when parent_id has been set.","examples":["true"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get all groups for multiple account ids","examples":[{"groups":[{"id":"string","account_id":"string","name":"string","machines_count":0,"policy_id":"string","policy_name":"string","updated_at":"2017-04-06T20:26:07.345213Z","is_default":true,"schedule_ids":["string"],"parent_id":"string","root_id":"string","ou_object_id":null,"child_group_count":0}],"total_count":1}],"properties":{"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"total_count":{"type":"number","title":"Total count"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"additionalProperties":false}}}}},"tags":["V2 (RMM) Groups"],"operationId":"api.v2.rmm.search.groups"}},"/api/v2/rmm/groups/{id}/machines":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["endpoints.performActions"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Update groups in bulks","required":["endpoints","groups"],"properties":{"endpoints":{"type":"array","title":"Endpoints","items":{"type":"object","title":"Endpoint items","required":["id","account_id"],"properties":{"id":{"type":"string","title":"machine id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"List of queries to select endpoints","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing  a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan  before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Delete Endpoints Bulk Body 200 Schema","required":["moved"],"properties":{"moved":{"type":"array","title":"IDs of the deleted endpoint","items":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}}},"tags":["V2 (RMM) Groups"],"operationId":"api.v2.rmm.post.groups.bulk"}},"/api/v2/rmm/accounts/{account_id}/parent_jobs/{correlation_id}/children":{"delete":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"correlation_id","required":true,"in":"path","description":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Cancel children jobs request body.","properties":{"constraints":{"type":"array","title":"Child Jobs Constraints","items":{"title":"Child Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]},{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},{"type":"string","title":"Child Jobs Enum Number Fields","enum":["status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Child Jobs Date Fields","enum":["created_at","expires_at","updated_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.delete.parent_jobs.children"},"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"correlation_id","required":true,"in":"path","description":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search children jobs across multiple accounts request body.","properties":{"sort_field":{"type":"string","title":"Child Jobs Sort Fields","enum":["created_at","expires_at","command","issued_by_name","issued_by_email","updated_at"]},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"Child Jobs Constraints","items":{"title":"Child Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]},{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},{"type":"string","title":"Child Jobs Enum Number Fields","enum":["status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Child Jobs Date Fields","enum":["created_at","expires_at","updated_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}},"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search children jobs response body.","properties":{"counts":{"type":"object","title":"Counts","properties":{"endpoints":{"type":"integer","title":"Number of related endpoints"},"accounts":{"type":"integer","title":"Number of related accounts"},"total":{"type":"integer","title":"Total number of child jobs"}},"allOf":[{"type":"object","title":"Job status counts.","required":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"],"properties":{"created":{"type":"integer","title":"Number of jobs with created status"},"sent":{"type":"integer","title":"Number of jobs with sent status"},"received":{"type":"integer","title":"Number of jobs with received status"},"processing":{"type":"integer","title":"Number of jobs with processing status"},"timed_out":{"type":"integer","title":"Number of jobs with timed_out status"},"success":{"type":"integer","title":"Number of jobs with success status"},"expired":{"type":"integer","title":"Number of jobs with expired status"},"cancelled":{"type":"integer","title":"Number of jobs with cancelled status"},"failed":{"type":"integer","title":"Number of jobs with failed status"}}}]},"jobs":{"type":"array","items":{"type":"object","additionalProperties":false,"properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The machine name"},"command":{"type":"string","title":"Command name"},"issued_at":{"type":"string","format":"date-time","title":"The issue date"},"issued_by_email":{"type":"string","title":"The email of the user who issued the job"},"issued_by_name":{"type":"string","title":"The name of the user who issued the job"},"issued_by":{"type":"string","nullable":true,"title":"The id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"cancelled_by":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"cancelled_by_name":{"type":"string","nullable":true,"title":"User who cancelled the job","examples":["John Doe"]},"expires_at":{"type":"string","format":"date-time","title":"The expire date"},"updated_at":{"type":"string","format":"date-time","title":"The last update date"},"state":{"type":"number","enum":[0,1,2,4,8,16,32,64,128,256],"title":"Filter job status. 0:UNKNOWN_STATUS, 1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED"},"reason":{"type":"string","nullable":true,"title":"The reason for the job cancellation","examples":["Unsupported feature for this OS version."]},"data":{"type":"string","title":"JSON stringified additional data"},"correlation_id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["jobs","next_cursor","counts"]}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.rmm.post.parent_jobs.children"}},"/api/v2/rmm/jobs/bulk":{"delete":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Cancel Jobs","anyOf":[{"required":["job_ids"]},{"required":["machine_ids"]},{"required":["groups"]}],"properties":{"job_ids":{"type":"array","title":"The Job IDs Schema","items":{"type":"string","title":"Job ID","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"machine_ids":{"type":"array","title":"The Machine IDs Schema","items":{"type":"string","title":"Machine ID","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"groups":{"type":"array","title":"Machines","items":{"type":"object","title":"List of queries to select endpoints","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"$ref":"#/definitions/constraint"}},"aggregations":{"items":{"$ref":"endpoint-aggregation-fields","type":"string"}},"sort_field":{"$ref":"endpoint-sort-fields","type":"string","title":"If the sort field is used, then sort_order is required."}}},{"$ref":"base-search"}],"definitions":{"constraint":{"oneOf":[{"$ref":"endpoint-constraints-simple"},{"$ref":"#/definitions/compound_constraint"}]},"compound_constraint":{"allOf":[{"$ref":"base-compound-constraint"},{"properties":{"allOf":{"type":"array","items":{"$ref":"#/definitions/constraint"}},"anyOf":{"type":"array","items":{"$ref":"#/definitions/constraint"}},"noneOf":{"type":"array","items":{"$ref":"#/definitions/constraint"}}},"anyOf":[{"required":["allOf"]},{"required":["anyOf"]},{"required":["noneOf"]}]}]}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.delete.jobs.bulk"},"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Isolate Request Body Schema","required":["endpoints","groups","command"],"properties":{"command":{"type":"string","title":"Command"},"requires_connected":{"type":"boolean","title":"Whether a connection needs to be initiated before issuing this jobs (i.e. active response shell)"},"data":{"type":"object","title":"Data","properties":{"scan_settings":{"type":"object","title":"Scan settings","properties":{"type":{"type":"string","title":"Type","enum":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"}}},"enable_shuriken":{"type":"boolean","title":"Enable shuriken"},"allow_postpone_reboot":{"type":"boolean","title":"Allow postpone reboot"},"type":{"type":"string","title":"Type"},"scan_path_from_list_file":{"type":"boolean","title":"Scan path from list file"},"scan_path":{"type":"string","title":"Scan path"},"add_scan_paths":{"type":"array","title":"Add scan paths","items":{"type":"string","title":"Add scan paths items"}},"no_archive":{"type":"boolean","title":"No archive"},"ark":{"type":"boolean","title":"Ark"},"remove":{"type":"boolean","title":"Remove"},"no_reboot":{"type":"boolean","title":"No reboot"},"reboot_delay":{"type":"integer","title":"Reboot delay"},"reboot_delay_rrule":{"type":"string","title":"Reboot delay rrule"},"reboot_message":{"type":"string","title":"Reboot message"},"pum_detection":{"type":"string","title":"Pum detection"},"pup_detection":{"type":"string","title":"Pup detection"},"scan_memory":{"type":"boolean","title":"Scan memory"},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"scan_file_system":{"type":"boolean","title":"Scan file system"},"scan_priority":{"type":"string","title":"Scan priority"},"scan_fixed_drives":{"type":"boolean","title":"Scan fixed drives"},"exclusions":{"type":"array","title":"Exclusions","items":{"type":"object","title":"Exclusion items","additionalProperties":true,"properties":{"value":{"type":"string","title":"Value"},"type":{"type":"string","title":"Type"},"exclude_from":{"type":"object","title":"Exclude from","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Exploit protection"},"malware_protection":{"type":["boolean","null"],"title":"Malware protection"},"ransomware_protection":{"type":["boolean","null"],"title":"Ransomware protection"},"suspicious_activity":{"type":["boolean","null"],"title":"Suspicious activity"},"website_protection":{"type":["boolean","null"],"title":"Website protection"}}}}}},"allow_postpone":{"type":["boolean","number"],"title":"Asset Reboot allow postpone"},"delay_in_seconds":{"type":"number","title":"Asset Reboot delay"},"message":{"type":"string","title":"Asset Reboot message"},"reasons":{"type":"number","title":"Asset Reboot reason: 0 RebootStatusClear, 1 RebootStatusDOR, 2 RebootStatusInstall, 3 RebootStatusUpgrade, 4 RebootStatusUnknown"},"restore_items":{"type":"array","title":"Detection IDs to restore from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"delete_items":{"type":"array","title":"Detection IDs to delete from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"application_name":{"type":"string","examples":["Chrome"]},"current_version":{"type":"string","examples":["96.0.4664.45"]},"new_version":{"type":"string","examples":["97.0.2103.01"]},"product":{"type":"number","product":[41]},"vendor":{"type":"string","examples":["Google"]},"architecture":{"type":"string","examples":["x86"]},"language":{"type":"string","examples":["tr-TR"]},"patches":{"type":"array","title":"Options for command.asset.patch","items":{"type":"object","properties":{"category":{"type":"string","examples":["feature_pack"]},"product":{"type":"string","examples":["Silverlight"]},"severity":{"type":"string","examples":["critical"]},"title":{"type":"string","examples":["Microsoft Silverlight (KB4481252)"]},"vendor":{"type":"string","examples":["Microsoft Corporation"]}}}}}},"endpoints":{"type":"array","title":"Machine IDs","items":{"type":"object","title":"Machine IDs items","required":["id","account_id"],"properties":{"id":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"Machine IDs","items":{"type":"object","title":"List of queries to select endpoints","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing  a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan  before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}]}},"relay_state":{"type":"string","title":"Relay state"},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"source_id":{"type":"string","title":"Source ID for relating the new parent job to an existing parent job without add them as children of that parent job.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Create job response","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"List of jobs","items":{"type":"object","title":"Job items","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The ID of the endpoint onto which the job was issued (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The ID of the job. You can use this ID to retrieve additional informations about the job and track its progress, as well as use it as a reference to handle webhooks notifications (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}},"total_count":{"type":"integer","title":"The total number of issued jobs"},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.post.jobs.bulk"}},"/api/v2/rmm/accounts/{account_id}/parent_jobs":{"delete":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Cancel Jobs","required":["correlation_ids"],"properties":{"correlation_ids":{"type":"array","title":"The Parent Job IDs Schema","items":{"type":"string","title":"Parent Job ID","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.delete.parent_jobs"},"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search parent jobs across multiple accounts request body.","properties":{"sort_field":{"type":"string","title":"Parent Jobs Sort Fields","enum":["created_at","expires_at","source_id","command","issued_by","issued_by_name","issued_by_email","accounts","endpoints","created","sent","received","processing","timed_out","success","expired","cancelled","failed","is_complete"]},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"Parent Jobs Constraints","items":{"title":"Parent Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]},{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs Boolean Fields","enum":["is_complete"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Parent Jobs Date Fields","enum":["created_at","expires_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Parent Jobs Number Fields","type":"string","enum":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals","not_equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]}]}},"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search parent jobs response body.","required":["jobs","total_count","next_cursor"],"properties":{"jobs":{"type":"array","items":{"type":"object","properties":{"correlation_id":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"source_id":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_name":{"type":"string","title":"The account name"},"created_at":{"type":"string","format":"date-time","title":"The expire date"},"expires_at":{"type":"string","format":"date-time","title":"The expire date"},"command":{"type":"string","title":"Command name"},"issued_by":{"type":"string","nullable":true,"title":"The id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_name":{"type":"string","nullable":true,"title":"The name of the user who issued the job"},"issued_by_email":{"type":"string","nullable":true,"title":"The email of the user who issued the job"},"is_complete":{"type":"boolean","title":"Status if job is completed."},"machine_id":{"type":"string","title":"Endpoint ID (if job is associated with one endpoint)."},"machine_name":{"type":"string","title":"Endpoint name (if job is associated with one endpoint)."},"endpoints":{"type":"number","title":"Number of endpoints related to current parent job."},"accounts":{"type":"number","title":"Number of related accounts."}},"allOf":[{"type":"object","title":"Job status counts.","required":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"],"properties":{"created":{"type":"integer","title":"Number of jobs with created status"},"sent":{"type":"integer","title":"Number of jobs with sent status"},"received":{"type":"integer","title":"Number of jobs with received status"},"processing":{"type":"integer","title":"Number of jobs with processing status"},"timed_out":{"type":"integer","title":"Number of jobs with timed_out status"},"success":{"type":"integer","title":"Number of jobs with success status"},"expired":{"type":"integer","title":"Number of jobs with expired status"},"cancelled":{"type":"integer","title":"Number of jobs with cancelled status"},"failed":{"type":"integer","title":"Number of jobs with failed status"}}}]}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.rmm.post.parent_jobs"}},"/api/v2/rmm/accounts/{account_id}/parent_jobs/{correlation_id}/children/summary":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"correlation_id","required":true,"in":"path","description":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get child jobs summary across multiple accounts request body.","properties":{"constraints":{"type":"array","title":"Child Jobs Constraints","items":{"title":"Child Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]},{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},{"type":"string","title":"Child Jobs Enum Number Fields","enum":["status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Child Jobs Date Fields","enum":["created_at","expires_at","updated_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}},"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get child jobs summary across multiple accounts response body.","required":["endpoints","accounts","total"],"properties":{"endpoints":{"type":"integer","title":"Number of related endpoints"},"accounts":{"type":"integer","title":"Number of related accounts"},"total":{"type":"integer","title":"Total number of child jobs"}},"allOf":[{"type":"object","title":"Job status counts.","required":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"],"properties":{"created":{"type":"integer","title":"Number of jobs with created status"},"sent":{"type":"integer","title":"Number of jobs with sent status"},"received":{"type":"integer","title":"Number of jobs with received status"},"processing":{"type":"integer","title":"Number of jobs with processing status"},"timed_out":{"type":"integer","title":"Number of jobs with timed_out status"},"success":{"type":"integer","title":"Number of jobs with success status"},"expired":{"type":"integer","title":"Number of jobs with expired status"},"cancelled":{"type":"integer","title":"Number of jobs with cancelled status"},"failed":{"type":"integer","title":"Number of jobs with failed status"}}}]}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.rmm.post.parent_jobs.children.summary"}},"/api/v2/rmm/jobs/export":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The format of the output","enum":["string","base64","binary"]},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["id","correlation_id","account_id","account_name","command","data","expires_at","issued_at","issued_by","issued_by_email","issued_by_name","cancelled_by","reason","machine_id","machine_name","status","updated_at","relay_state","tags.alias","data.scan_settings.remove","data.scan_settings.type"]},"mapValues":{"type":"object","title":"Rename values","description":"Only string values are mapped, but numbers and booleans will be cast as strings. If a value is not defined it will not be changed","additionalProperties":{"type":["string","number","boolean"]}}}}},"groups":{"type":"array","title":"List of search queries","items":{"type":"object","title":"List of queries to fetch jobs. Refer to the search jobs endpoint","allOf":[{"type":"object","title":"Search jobs request.","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by a single job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"command":{"title":"Filter the search by endpoint name command name","oneOf":[{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},{"type":"array","items":{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},"minItems":1,"uniqueItems":true}],"examples":["command.asset.refresh"]},"endpoint":{"type":"string","title":"Filter the search by endpoint name.","description":"Search for occurrences of the given value in the host_name fully_qualified_host_name and alias"},"machine_id":{"title":"Filter the search Machine Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"colleraltion_id":{"type":"string","title":"Filter the search Correlation Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"issued_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_email":{"type":"string","title":"Filter the search by the email of the user who issued the job. Contains operator."},"cancelled_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_at_before":{"type":"string","format":"date-time","title":"Results include jobs that have been issued before the specified date"},"issued_at_after":{"type":"string","format":"date-time","title":"Results include jobs that have been issued after the specified date"},"expires_at_before":{"type":"string","format":"date-time","title":"Results include jobs that expire before the specified date"},"expires_at_after":{"type":"string","format":"date-time","title":"Results include jobs that expire after the specified date"},"status":{"type":"number","title":"Filter the search by status. You can also select multiple statuses using their sum","description":"1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED","minimum":1,"maximum":511},"sort_field":{"type":"string","title":"Sort field","default":"issued_at","enum":["command","issued_by","issued_at","expires_at","status","machine_name","account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"populate":{"type":"object","title":"The populate object Schema","properties":{"online":{"type":"boolean","title":"Populate the results with endpoint online/offline status"}}}}}]}}}}],"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","required":["account_ids"],"title":"List of queries to fetch endpoints. Refer to the search jobs endpoint (sorting and pagination are ignored)","allOf":[{"type":"object","title":"Search jobs request.","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by a single job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"command":{"title":"Filter the search by endpoint name command name","oneOf":[{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},{"type":"array","items":{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},"minItems":1,"uniqueItems":true}],"examples":["command.asset.refresh"]},"endpoint":{"type":"string","title":"Filter the search by endpoint name.","description":"Search for occurrences of the given value in the host_name fully_qualified_host_name and alias"},"machine_id":{"title":"Filter the search Machine Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"colleraltion_id":{"type":"string","title":"Filter the search Correlation Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"issued_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_email":{"type":"string","title":"Filter the search by the email of the user who issued the job. Contains operator."},"cancelled_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_at_before":{"type":"string","format":"date-time","title":"Results include jobs that have been issued before the specified date"},"issued_at_after":{"type":"string","format":"date-time","title":"Results include jobs that have been issued after the specified date"},"expires_at_before":{"type":"string","format":"date-time","title":"Results include jobs that expire before the specified date"},"expires_at_after":{"type":"string","format":"date-time","title":"Results include jobs that expire after the specified date"},"status":{"type":"number","title":"Filter the search by status. You can also select multiple statuses using their sum","description":"1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED","minimum":1,"maximum":511},"sort_field":{"type":"string","title":"Sort field","default":"issued_at","enum":["command","issued_by","issued_at","expires_at","status","machine_name","account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"populate":{"type":"object","title":"The populate object Schema","properties":{"online":{"type":"boolean","title":"Populate the results with endpoint online/offline status"}}}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.post.export.jobs"}},"/api/v2/rmm/accounts/{account_id}/jobs/{id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Job by ID response","required":["id","machine_id","machine_name","command","issued_at","issued_by_email","issued_by_name","issued_by","expires_at","updated_at","state"],"properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"Machine name"},"command":{"type":"string","title":"Command"},"issued_at":{"type":"string","title":"Issued at (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"issued_by_email":{"type":"string","title":"Issued by email"},"issued_by_name":{"type":"string","title":"The Issued_by_name Schema"},"issued_by":{"type":"string","title":"Issued by user ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"expires_at":{"type":"string","title":"Expires at (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"updated_at":{"type":"string","title":"Updated at","examples":["2020-03-23T17:23:17.860482Z"]},"state":{"type":"string","title":"State (Ex. \"COMPLETED\")","pattern":"^PENDING|STARTED|TIMED_OUT|COMPLETED|EXPIRED|FAILED|CANCELLED$","examples":["COMPLETED"]},"relay_state":{"type":"string","title":"Relay state"},"scan_id":{"type":"string","title":"Scan ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.get.jobs.id"}},"/api/v2/rmm/accounts/{account_id}/parent_jobs/{correlation_id}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"correlation_id","required":true,"in":"path","description":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get parent jobs response body.","required":[],"properties":{"correlation_id":{"type":["string","null"],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":["string","null"],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"source_id":{"type":["string","null"],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_name":{"type":"string","title":"The account name"},"created_at":{"type":"string","format":"date-time","title":"The expire date"},"expires_at":{"type":"string","format":"date-time","title":"The expire date"},"command":{"type":"string","title":"Command name"},"issued_by":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_name":{"type":["string","null"],"title":"The name of the user who issued the job"},"issued_by_email":{"type":["string","null"],"title":"The email of the user who issued the job"},"is_complete":{"type":"boolean","title":"Status if job is completed."},"endpoints":{"type":"number","title":"Number of endpoints related to current parent job."},"accounts":{"type":"number","title":"Number of related accounts."}},"allOf":[{"type":"object","title":"Job status counts.","required":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"],"properties":{"created":{"type":"integer","title":"Number of jobs with created status"},"sent":{"type":"integer","title":"Number of jobs with sent status"},"received":{"type":"integer","title":"Number of jobs with received status"},"processing":{"type":"integer","title":"Number of jobs with processing status"},"timed_out":{"type":"integer","title":"Number of jobs with timed_out status"},"success":{"type":"integer","title":"Number of jobs with success status"},"expired":{"type":"integer","title":"Number of jobs with expired status"},"cancelled":{"type":"integer","title":"Number of jobs with cancelled status"},"failed":{"type":"integer","title":"Number of jobs with failed status"}}}]}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.rmm.get.parent_jobs"}},"/api/v2/rmm/accounts/{account_id}/jobs":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Add job to queue payload","required":["machine_ids","command"],"properties":{"machine_ids":{"type":"array","title":"Endpoint IDs","items":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"relay_state":{"type":"string","title":"Relay state"},"requires_connected":{"type":"boolean","title":"Whether a connection needs to be initiated before issuing this jobs (i.e. active response shell)"},"command":{"type":"string","title":"Command"},"data":{"type":"object","title":"Data","properties":{"scan_settings":{"type":"object","title":"Scan settings","properties":{"type":{"type":"string","title":"Type","enum":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":["boolean","string"],"title":"Remove"}}},"enable_shuriken":{"type":"boolean","title":"Enable shuriken"},"allow_postpone_reboot":{"type":"boolean","title":"Allow postpone reboot"},"type":{"type":"string","title":"Type"},"scan_path_from_list_file":{"type":"boolean","title":"Scan path from list file"},"scan_path":{"type":"string","title":"Scan path"},"add_scan_paths":{"type":"array","title":"Add scan paths","items":{"type":"string","title":"Add scan paths items"}},"no_archive":{"type":"boolean","title":"No archive"},"ark":{"type":"boolean","title":"Ark"},"remove":{"type":"boolean","title":"Remove"},"no_reboot":{"type":"boolean","title":"No reboot"},"reboot_delay":{"type":"integer","title":"Reboot delay"},"reboot_delay_rrule":{"type":"string","title":"Reboot delay rrule"},"reboot_message":{"type":"string","title":"Reboot message"},"pum_detection":{"type":"string","title":"Pum detection"},"pup_detection":{"type":"string","title":"Pup detection"},"scan_memory":{"type":"boolean","title":"Scan memory"},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"scan_file_system":{"type":"boolean","title":"Scan file system"},"scan_priority":{"type":"string","title":"Scan priority"},"scan_fixed_drives":{"type":"boolean","title":"Scan fixed drives"},"exclusions":{"type":"array","title":"Exclusions","items":{"type":"object","title":"Items","additionalProperties":true,"properties":{"value":{"type":"string","title":"Value"},"type":{"type":"string","title":"Type"},"exclude_from":{"type":"object","title":"Exclude from","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Exploit protection"},"malware_protection":{"type":["boolean","null"],"title":"Malware protection"},"ransomware_protection":{"type":["boolean","null"],"title":"Ransomware protection"},"suspicious_activity":{"type":["boolean","null"],"title":"Suspicious activity"},"website_protection":{"type":["boolean","null"],"title":"Website protection"}}}}}},"allow_postpone":{"type":["boolean","number"],"title":"Asset Reboot allow postpone"},"delay_in_seconds":{"type":"number","title":"Asset Reboot delay"},"message":{"type":"string","title":"Asset Reboot message"},"reasons":{"type":"number","title":"Asset Reboot reason: 0 RebootStatusClear, 1 RebootStatusDOR, 2 RebootStatusInstall, 3 RebootStatusUpgrade, 4 RebootStatusUnknown"},"restore_items":{"type":"array","title":"Detection IDs to restore from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"delete_items":{"type":"array","title":"Detection IDs to delete from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"application_name":{"type":"string","examples":["Chrome"]},"current_version":{"type":"string","examples":["96.0.4664.45"]},"new_version":{"type":"string","examples":["97.0.2103.01"]},"product":{"type":"number","product":[41]},"vendor":{"type":"string","examples":["Google"]},"architecture":{"type":"string","examples":["x86"]},"language":{"type":"string","examples":["tr-TR"]},"patches":{"type":"array","title":"Options for command.asset.patch","items":{"type":"object","properties":{"category":{"type":"string","examples":["feature_pack"]},"product":{"type":"string","examples":["Silverlight"]},"severity":{"type":"string","examples":["critical"]},"title":{"type":"string","examples":["Microsoft Silverlight (KB4481252)"]},"vendor":{"type":"string","examples":["Microsoft Corporation"]}}}}}},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"source_id":{"type":"string","title":"Source ID for relating the new parent job to an existing parent job without add them as children of that parent job.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Add job to queue response","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"Jobs","items":{"type":"object","title":"Jobs items","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The ID of the endpoint onto which the job was issued (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The ID of the job. You can use this ID to retrieve additional information about the job and track its progress, as well as use it as a reference to handle webhooks notifications (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"total_count":{"type":"integer","title":"The total number of issued jobs"},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.post.jobs"}},"/api/v2/rmm/accounts/{account_id}/jobs/quarantine/bulk":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Issue Quarantine Jobs Bulk Request","properties":{"command":{"type":"string","enum":["command.threat.quarantine.remove","command.threat.quarantine.restore"]},"groups":{"type":"array","items":{"type":"object","title":"Search quarantine","properties":{"fields":{"type":"array","title":"Specify which fields will be included in the response","items":{"enum":["trace_id","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","account_id","account_name","parent_account_id","detection_id","correlation_hash","scanned_at","scanned_at_offset_seconds","reported_at","resource_created_at","resource_modified_at","threat_name","type","path","category","is_rtp_stream_event","updated_at","cleaned_at","parent_detection_id","rule_id","md5","sha256","online","auto_removal_at"],"type":"string"},"default":["trace_id","scan_id","machine_id","account_id"]},"sort_field":{"type":"string","title":"Sort field","enum":["scanned_at","auto_removal_at"],"default":"scanned_at"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"Quarantine constraints","items":{"title":"Quarantine Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Quarantine UID String Fields","enum":["id","scan_id","machine_id","detection_id","parent_detection_id","account_id"]},{"title":"Quarantine Simple String Fields","type":"string","enum":["correlation_hash","threat_name","machine_name","path","md5","sha256","scanned_at_offset_seconds","trace_id","rule_id"]},{"type":"string","title":"Quarantine Enum String Fields","enum":["type","category"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Quarantine UID String Fields","enum":["id","scan_id","machine_id","detection_id","parent_detection_id","account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Quarantine Simple String Fields","type":"string","enum":["correlation_hash","threat_name","machine_name","path","md5","sha256","scanned_at_offset_seconds","trace_id","rule_id"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Quarantine Boolean Fields","enum":["is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Quarantine Date Fields","enum":["scanned_at","reported_at","cleaned_at","updated_at","resource_created_at","resource_modified_at","auto_removal_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}}},"delete_items":{"type":"array"},"restore_items":{"type":"array"}},"if":{"properties":{"command":{"const":"command.threat.quarantine.remove"}}},"then":{"not":{"required":["restore_items"]}},"else":{"not":{"required":["delete_items"]}},"required":["command"],"definitions":{"quarantine_item":{"type":"object","required":["detection_id","machine_id","account_id"],"properties":{"detection_id":{"type":"string","description":"Detection ID"},"machine_id":{"type":"string","description":"Machine ID"},"account_id":{"type":"string","description":"Account ID"}}}}}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Issue quarantine job response","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"List of jobs","items":{"type":"object","title":"Job items","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The ID of the endpoint onto which the job was issued (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","format":"uuid"},"job_id":{"type":["string","null"],"title":"The ID of the job. You can use this ID to retrieve additional informations about the job and track its progress, as well as use it as a reference to handle webhooks notifications (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")"}}}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"string","title":"Endpoint ID"}},"total_count":{"type":"integer","title":"The total number of issued jobs"},"processed_items":{"type":"integer","title":"The total number of quarantined items processed"},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","format":"uuid"}}}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.post.quarantine.jobs.bulk"}},"/api/v2/rmm/accounts/{account_id}/parent_jobs/export":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["select","format","groups"],"properties":{"groups":{"type":"array","items":{"type":"object","properties":{"constraints":{"type":"array","title":"Parent Jobs constraints","items":{"title":"Parent Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]},{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs Boolean Fields","enum":["is_complete"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Parent Jobs Date Fields","enum":["created_at","expires_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Parent Jobs Number Fields","type":"string","enum":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals","not_equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]}]}}}}},"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"filename":{"type":"string","title":"The name of the output file if download is set to true"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["correlation_id","account_id","account_name","source_id","created_at","expires_at","command","issued_by","issued_by_name","issued_by_email","machine_id","machine_name","is_complete","endpoints","accounts","created","sent","received","processing","timed_out","success","expired","failed","cancelled"]},"mapValues":{"type":"object","title":"Map values to new values"}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Jobs"],"operationId":"api.rmm.post.parent_jobs.export"}},"/api/v2/rmm/accounts/{account_id}/parent_jobs/summary":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get parent jobs summary across multiple accounts request body. ","properties":{"constraints":{"type":"array","title":"Parent Jobs Constraints","items":{"title":"Parent Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]},{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs Boolean Fields","enum":["is_complete"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Parent Jobs Date Fields","enum":["created_at","expires_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Parent Jobs Number Fields","type":"string","enum":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals","not_equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]}]}},"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get parent jobs summary response across multiple account response body.","required":["parent_jobs","parent_completed_jobs","total"],"properties":{"parent_jobs":{"type":"integer","title":"Number of parent jobs"},"parent_completed_jobs":{"type":"integer","title":"Number of parent completed jobs"},"total":{"type":"integer","title":"Total number of child jobs"}},"allOf":[{"type":"object","title":"Job status counts.","required":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"],"properties":{"created":{"type":"integer","title":"Number of jobs with created status"},"sent":{"type":"integer","title":"Number of jobs with sent status"},"received":{"type":"integer","title":"Number of jobs with received status"},"processing":{"type":"integer","title":"Number of jobs with processing status"},"timed_out":{"type":"integer","title":"Number of jobs with timed_out status"},"success":{"type":"integer","title":"Number of jobs with success status"},"expired":{"type":"integer","title":"Number of jobs with expired status"},"cancelled":{"type":"integer","title":"Number of jobs with cancelled status"},"failed":{"type":"integer","title":"Number of jobs with failed status"}}}]}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.rmm.post.parent_jobs.summary"}},"/api/v2/rmm/accounts/{account_id}/parent_jobs/{correlation_id}/children/reissue":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"correlation_id","required":true,"in":"path","description":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Reissue children jobs request body.","properties":{"constraints":{"type":"array","title":"Child Jobs Constraints","items":{"title":"Child Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]},{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},{"type":"string","title":"Child Jobs Enum Number Fields","enum":["status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Child Jobs Date Fields","enum":["created_at","expires_at","updated_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.reissue.parent_jobs.children"}},"/api/v2/rmm/accounts/{account_id}/parent_jobs/reissue":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Cancel Jobs","required":["correlation_ids"],"properties":{"correlation_ids":{"type":"array","title":"The Parent Job IDs Schema","items":{"type":"string","title":"Parent Job ID","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"title":"Reissue parent jobs requst body.","type":"object","required":["success","total_count"],"properties":{"success":{"type":"array","items":{"correlation_id":{"type":"string","format":"uuid"},"jobs":{"type":"array","items":{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"account_id":{"type":"string","format":"uuid"},"machine_id":{"type":"string","format":"uuid"}},"required":["job_id","machine_id"]}}}},"errors":{"type":"array","items":{"type":"object","properties":{"job_id":{"type":"string"},"machine_id":{"type":"string","format":"uuid"},"correlation_id":{"type":"string","format":"uuid"},"account_id":{"type":"string","format":"uuid"}},"required":["job_id","machine_id"]}},"total_count":{"type":"integer","title":"The total number of issued jobs"}},"additionalProperties":false}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.reissue.parent_jobs"}},"/api/v2/rmm/jobs/search":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"Search jobs request.","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by a single job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"command":{"title":"Filter the search by endpoint name command name","oneOf":[{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},{"type":"array","items":{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},"minItems":1,"uniqueItems":true}],"examples":["command.asset.refresh"]},"endpoint":{"type":"string","title":"Filter the search by endpoint name.","description":"Search for occurrences of the given value in the host_name fully_qualified_host_name and alias"},"machine_id":{"title":"Filter the search Machine Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"colleraltion_id":{"type":"string","title":"Filter the search Correlation Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"issued_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_email":{"type":"string","title":"Filter the search by the email of the user who issued the job. Contains operator."},"cancelled_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_at_before":{"type":"string","format":"date-time","title":"Results include jobs that have been issued before the specified date"},"issued_at_after":{"type":"string","format":"date-time","title":"Results include jobs that have been issued after the specified date"},"expires_at_before":{"type":"string","format":"date-time","title":"Results include jobs that expire before the specified date"},"expires_at_after":{"type":"string","format":"date-time","title":"Results include jobs that expire after the specified date"},"status":{"type":"number","title":"Filter the search by status. You can also select multiple statuses using their sum","description":"1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED","minimum":1,"maximum":511},"sort_field":{"type":"string","title":"Sort field","default":"issued_at","enum":["command","issued_by","issued_at","expires_at","status","machine_name","account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"populate":{"type":"object","title":"The populate object Schema","properties":{"online":{"type":"boolean","title":"Populate the results with endpoint online/offline status"}}}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search jobs result","properties":{"jobs":{"type":"array","items":{"type":"object","additionalProperties":false,"properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_name":{"type":"string","title":"The account name"},"command":{"type":"string","title":"Command name"},"data":{"type":"string","title":"JSON stringified additional data"},"expires_at":{"type":"string","format":"date-time","title":"The expire date"},"issued_at":{"type":"string","format":"date-time","title":"The issue date"},"issued_by":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_email":{"type":"string","title":"The email of the user who issued the job"},"issued_by_name":{"type":"string","title":"The name of the user who issued the job"},"cancelled_by":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"cancelled_by_email":{"type":"string","nullable":true,"title":"The email of the user who cancelled the job"},"cancelled_by_name":{"type":"string","nullable":true,"title":"The name of the user who cancelled the job"},"machine_id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The machine name"},"status":{"type":"number","enum":[0,1,2,4,8,16,32,64,128,256],"title":"Filter job status. 0:UNKNOWN_STATUS, 1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED"},"updated_at":{"type":"string","format":"date-time","title":"The last update date"},"reason":{"type":"string","nullable":true,"title":"Reason of cancellation or failure"},"relay_state":{"type":"string","title":"Relay state"},"tags":{"type":"object","properties":{"alias":{"type":"string","title":"Alias"}}},"online":{"type":"boolean","title":"Endpoint connection status (populated only if the populate is set)"}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["jobs","next_cursor"]}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.search.jobs"}},"/api/v2/rmm/jobs/search-groupby":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tasks.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"The Post Jobs Search GroupBy Request Schema","required":["group_by"],"allOf":[{"type":"object","title":"Search jobs request.","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by a single job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"command":{"title":"Filter the search by endpoint name command name","oneOf":[{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},{"type":"array","items":{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},"minItems":1,"uniqueItems":true}],"examples":["command.asset.refresh"]},"endpoint":{"type":"string","title":"Filter the search by endpoint name.","description":"Search for occurrences of the given value in the host_name fully_qualified_host_name and alias"},"machine_id":{"title":"Filter the search Machine Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"colleraltion_id":{"type":"string","title":"Filter the search Correlation Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"issued_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_email":{"type":"string","title":"Filter the search by the email of the user who issued the job. Contains operator."},"cancelled_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_at_before":{"type":"string","format":"date-time","title":"Results include jobs that have been issued before the specified date"},"issued_at_after":{"type":"string","format":"date-time","title":"Results include jobs that have been issued after the specified date"},"expires_at_before":{"type":"string","format":"date-time","title":"Results include jobs that expire before the specified date"},"expires_at_after":{"type":"string","format":"date-time","title":"Results include jobs that expire after the specified date"},"status":{"type":"number","title":"Filter the search by status. You can also select multiple statuses using their sum","description":"1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED","minimum":1,"maximum":511},"sort_field":{"type":"string","title":"Sort field","default":"issued_at","enum":["command","issued_by","issued_at","expires_at","status","machine_name","account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"populate":{"type":"object","title":"The populate object Schema","properties":{"online":{"type":"boolean","title":"Populate the results with endpoint online/offline status"}}}}}],"properties":{"group_by":{"type":"string","title":"The field to group by","description":"Note: timestamp fields could have repeated values in pagination, if the interval between timestamps is less that 1 second","enum":["id","account_id","account_name","command","expires_at","issued_at","issued_by","issued_by_email","issued_by_name","cancelled_by","machine_id","machine_name","status","updated_at","relay_state"]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The distinct values of the group_by field","default":[],"items":{"type":"object","required":["value","total"],"properties":{"value":{"title":"Value of the groupBy field","type":["string","number"]},"machine_name":{"title":"Machine name. It will be displayed when grouping by machine_id","type":"string"},"account_name":{"title":"Account name. It will be displayed when grouping by account_id","type":"string"},"issued_by_name":{"title":"User name. It will be displayed when grouping by issued_by","type":"string"},"issued_by_email":{"title":"User mail. It will be displayed when grouping by issued_by","type":"string"},"total":{"title":"Total count of the elements in the group","type":"number"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Jobs"],"operationId":"api.v2.rmm.search.jobs.group"}},"/api/v2/rmm/os-patches/export":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","group_name","object_guid","host_name","fully_qualified_host_name","domain_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","group.name","group.policy_id","group.policy_name","endpoint.last_day_seen","endpoint.last_user","alias","ignored_until","ignore_rule_ids","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch endpoints","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}},{"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","title":"Search assets CVE request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"type":"object","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) OS Patches"],"operationId":"api.v2.rmm.post.export.os-patches"}},"/api/v2/rmm/os-patches/export/async":{"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","group_name","object_guid","host_name","fully_qualified_host_name","domain_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","group.name","group.policy_id","group.policy_name","endpoint.last_day_seen","endpoint.last_user","alias","ignored_until","ignore_rule_ids","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch endpoints","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}},{"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","title":"Search assets CVE request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"type":"object","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) OS Patches"],"operationId":"api.v2.rmm.post.export.os-patches.async"}},"/api/v2/rmm/os-patches":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search assets CVE request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"type":"object","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search OS Patches result","properties":{"results":{"type":"array","items":{"properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"group_name":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"product":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"display_name":{"type":"string"},"domain_name":{"type":"string"},"created_at":{"type":"string"},"object_guid":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"severity":{"type":"string"},"category":{"type":"string"},"security_update_id":{"type":"string"},"patch_id":{"type":"string"},"released_at":{"type":"string"},"size":{"type":"number"},"reboot_required":{"type":"boolean"},"preview_patch":{"type":"boolean"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"endpoint":{"properties":{"last_user":{"type":"string"},"last_day_seen":{"type":"string","examples":["2020-06-01T09:52:10.579Z"]}}},"group":{"properties":{"name":{"type":"string"},"policy_id":{"type":"string"},"policy_name":{"type":"string"}}},"ignored_until":{"type":"string","format":"date-time"},"ignore_rule_ids":{"type":"array","items":{"type":"string","format":"uuid"}},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["results","total_count"]}}}}},"tags":["V2 (RMM) OS Patches"],"operationId":"api.v2.rmm.search.os-patches"}},"/api/v2/rmm/os-patches/search-groupby":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["patchManagement.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Request Schema","required":["group_by"],"allOf":[{"type":"object","title":"Search assets CVE request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"type":"object","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}],"properties":{"group_by":{"type":"string","title":"The sort field Schema","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":["string","boolean"],"title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"fully_qualified_host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"tags":{"type":"object","additionalProperties":true,"title":"The tags Schema (only for machine_id aggregation)"},"account_id":{"type":"string","title":"The account_id Schema (only for machine_id aggregation)"},"group_name":{"type":"string","title":"The group name Schema (only for group_id aggregation)"},"account_name":{"type":"string","title":"The account_name Schema (only for group_id and account_id aggregation)"},"title":{"type":"string","title":"The title schema (only for patch_id aggregation)"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) OS Patches"],"operationId":"api.v2.rmm.search.os-patches.group"}},"/api/v2/rmm/accounts/{account_id}/license/amend":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["account.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","properties":{"request":{"type":"object","properties":{"utm":{"type":"object","properties":{"utm_campaign":{"type":"string"},"utm_source":{"type":"string"},"utm_medium":{"type":"string"},"utm_content":{"type":"string"},"utm_term":{"type":"string"}}},"source":{"type":"string"},"request_type":{"type":"string","enum":["amend-eval"]},"product_requested":{"type":"string","description":"TDCOR-B, TDCORS-B, TDADV-B, TDADVS-B, MBCM-B, MBDNS-B, TDEMS-B"},"add_ons":{"type":"string","description":"A comma separated list of add-ons SKUs"},"user":{"type":"object","properties":{"email":{"type":"string","format":"email"},"name":{"type":"string"}}}},"required":["request_type","product_requested"]},"sf_account_id":{"type":"string"},"account_name":{"type":"string"},"license_key":{"type":"string"},"trial_requested":{"type":"boolean"},"lead_source":{"type":"string"},"lead_source_detail":{"type":"string","examples":["CTA Promo-Info Requested","CTA Promo-Remind Me Later"]},"cancel_details":{"type":"string"},"campaign_id":{"type":"string"},"account_type":{"type":"string","enum":["nebula","oneview"]}},"required":["trial_requested","account_type"]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{}}}}},"tags":["V2 (RMM) Licensing"],"operationId":"api.rmm.post.licensing.amend"}},"/api/v2/rmm/license/{license_key}":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Your license key","properties":{"license_key":{"type":"string","title":"The newly generated license key"},"catalogs":{"type":"array","title":"The catalogs associated with this license","items":{"type":"string","title":"list of entitlements"}},"entitlements":{"type":"array","title":"The entitlements associated with this request","items":{"type":"object","title":"list of entitlements","properties":{"name":{"type":"string","title":"Name of the entitlement"},"code":{"type":"string","title":"Code of the entitlement"},"status":{"type":"string","title":"status of the entitlement"},"term_ends_on":{"type":"string","title":"Expiry date"},"original_start_date":{"type":"string","title":"start date"},"catalog":{"type":"array","items":{"type":"string"},"title":"catalog codes"},"volume_purchased":{"type":"number","title":"number of seats"},"volume_used":{"type":"string","title":"seats used"},"term_length":{"type":"number","title":"length of term"}}}}}}}}}},"tags":["V2 (RMM) Licensing"],"operationId":"api.rmm.get.licensing"}},"/api/v2/rmm/licenses":{"get":{"status":{},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Licensing"],"operationId":"api.rmm.get.catalogs.licensing"}},"/api/v2/rmm/license/{license_key}/usage":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"webhook_url","required":true,"in":"query","description":"URL to send the result to.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Your license key","properties":{"license_key":{"type":"string","title":"The newly generated license key"},"message":{"type":"string","title":"A message indicating whether the webhook result was sent or not"}}}}}}},"tags":["V2 (RMM) Licensing"],"operationId":"api.rmm.get.usage.licensing"}},"/api/v2/rmm/license":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["account.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Your license","required":["license_key","entitlements"],"properties":{"license_key":{"type":"string","title":"The license key associated to your client."},"id":{"type":"string","title":"The license id associated to your client."},"entitlements":{"title":"The list of entitlements for this license","type":"array","items":{"title":"The entitlement specification","type":"object","required":["catalog_code","seats","term_type"],"properties":{"catalog_code":{"type":"string","title":"Catalog code. Fetch all catalogs to see available catalog codes"},"term_type":{"type":"string","title":"The term type of this license. Use 'utility' for live usage","default":"utility","enum":["utility","cloud_evaluation","subscription","evaluation","nfr"]},"seats":{"type":"number","title":"The number of seats to allocate for this "},"start_date":{"type":"string","title":"When this license should start being valid"},"end_date":{"type":"string","title":"When this license should end being valid"}}}}}}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Your license key","properties":{"license_key":{"type":"string","title":"The newly generated license key"},"id":{"type":"string","title":"The id of this license key. Store it along with the license_key. This is required to allow you updating the license terms"}}}}}}},"tags":["V2 (RMM) Licensing"],"operationId":"api.rmm.post.licensing"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["account.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Your license","required":["license_key","id","entitlements"],"properties":{"license_key":{"type":"string","title":"The license key associated to your client."},"id":{"type":"string","title":"The license id associated to your client."},"entitlements":{"title":"The list of entitlements for this license","type":"array","items":{"title":"The entitlement specification","type":"object","required":["catalog_code","seats","term_type"],"properties":{"catalog_code":{"type":"string","title":"Catalog code. Fetch all catalogs to see available catalog codes"},"term_type":{"type":"string","title":"The term type of this license. Use 'utility' for live usage","default":"utility","enum":["utility","cloud_evaluation","subscription","evaluation","nfr"]},"seats":{"type":"number","title":"The number of seats to allocate for this "},"start_date":{"type":"string","title":"When this license should start being valid"},"end_date":{"type":"string","title":"When this license should end being valid"}}}}}}}}},"responses":{"202":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Your license key","properties":{"updated":{"type":"boolean","title":"Whether the update was successful or not. To get new data about the license, look it up using the GET license api"}}}}}}},"tags":["V2 (RMM) Licensing"],"operationId":"api.rmm.put.licensing"}},"/api/v2/rmm/accounts/{account_id}/schedules/{id}":{"delete":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["schedules.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Schedules"],"operationId":"api.rmm.delete.schedules"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["schedules.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}}}}},"tags":["V2 (RMM) Schedules"],"operationId":"api.rmm.get.schedule.id"},"put":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["schedules.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Update schedule","required":["etag"],"properties":{"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"name":{"type":"string","title":"Name"},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Command is enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","enum":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","enum":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","enum":["Detect","Ignore"]},"scan_path":{"type":"array","title":"Scan path","items":{"type":"string","minLength":1}},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"}}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}}}}},"tags":["V2 (RMM) Schedules"],"operationId":"api.rmm.put.schedule"}},"/api/v2/rmm/accounts/{account_id}/schedules":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["schedules.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Collection of schedules","required":["schedules","total_count","next_cursor"],"properties":{"schedules":{"type":"array","title":"Schedules","items":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Schedules"],"operationId":"api.rmm.get.schedules"},"post":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["schedules.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Create schedule","properties":{"name":{"type":"string","title":"Name"},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Command is enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","enum":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","enum":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","enum":["Detect","Ignore"]},"scan_path":{"type":"array","title":"Scan path","items":{"type":"string","minLength":1}},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"}}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}}}}},"tags":["V2 (RMM) Schedules"],"operationId":"api.rmm.post.schedule"}},"/api/v2/rmm/accounts/schedules":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["schedules.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get schedules for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get all schedules for multiple account ids","examples":[{"schedules":[{"id":"string","name":"string","etag":"string","command":"command.threat.scan","rrule":"FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100","enabled":true,"command_data":{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true},"group_ids":["string"]}],"total_count":1}],"properties":{"schedules":{"type":"array","title":"Schedules","items":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}},"total_count":{"type":"number","title":"Total count"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"additionalProperties":false}}}}},"tags":["V2 (RMM) Schedules"],"operationId":"api.v2.rmm.search.schedules"}},"/api/v2/rmm/accounts/{account_id}/schedules/{id}/groups":{"put":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["schedules.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Group IDs","required":["group_ids"],"properties":{"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"UUID of Group","examples":["dc5e6ceb-e57f-4bf3-8b6d-df1d369be279"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}}}}},"tags":["V2 (RMM) Schedules"],"operationId":"api.rmm.put.schedule.groupids"}},"/api/v2/rmm/accounts":{"post":{"security":[{"oauth_ac":["create:accounts"]},{"client_credentials":["create:accounts"]},{"nebula":[]},{"user_permissions":["account.manage","sites.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create a managed account","required":["name","license_key","owner_user_name","owner_user_email"],"properties":{"name":{"type":"string","title":"The friendly name for the account"},"owner_user_name":{"type":"string","title":"The name of the owner of the account"},"owner_user_email":{"type":"string","title":"The email of the owner of the account"},"license_key":{"type":"string","title":"A valid license key. You can create license keys using the Licensing APIs"},"disable_owner_invite":{"type":"boolean","default":true,"title":"Whether to send an invite to the owner to access the Nebula console"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Your license key","properties":{"license_key":{"type":"string","title":"The license key associated with the account"},"id":{"type":"string","title":"The id of the account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"The Name of the account"},"options":{"type":"object","title":"Optional field options. Information for MSP.","properties":{"msp":{"type":"object","title":"MSP","properties":{"name":{"type":"string","title":"Name"},"redirect_url":{"type":"string","title":"Redirect URL"}}}}},"account_token":{"type":"string","title":"the account token of this account for registering endpoints"},"client_id":{"type":"string","title":"The default client_id for this account, if any"},"default_policy_id":{"type":"string","title":"The policy ID associated with this account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"default_group_id":{"type":"string","title":"The group ID associated with this account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"owner_id":{"type":"string","format":"uuid","title":"The nebula account owner user ID"},"created_at":{"type":"string","title":"When this account has been created (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"updated_at":{"type":"string","title":"When the account has been updated the last time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"product_license_info":{"type":"array","title":"Product license information","items":{"type":"object","properties":{"licensed_product":{"type":"string","title":"Licensed product","description":"The licensed products","default":"","examples":["MBAE-B,MBAM-B,MBBR-B,MBFT-B,MBRX-B,NCCA-B,NCEP-B,NCRM-B"]},"combo_code":{"type":"string","title":"Combo code","examples":["NEBULA-EP-COMBO"]},"catalog_code":{"type":"string","title":"Catalog code","default":"","examples":["BUS-CLOUD-EPP-01"]},"licensed_seats":{"type":"integer","title":"The number of seats licensed","default":0,"examples":[5]},"license_expires_at":{"type":"string","title":"When the license expires","default":"","examples":["2021-03-18T00:00:00Z"]},"license_term_type":{"type":"string","title":"The License_term_type Schema","default":"","examples":["utility"]},"licensed_ir_remediations":{"type":"integer","title":"Licensed ir remediations","default":0,"examples":[0]},"license_status":{"type":"string","title":"License status","default":"","examples":["active"]},"ir_remediations_count":{"type":"integer","title":"Ir remediations count","default":0,"examples":[0]},"machine_counts":{"type":"array","title":"Endpoints linked to products","items":{"type":"object","title":"Items","properties":{"product_type":{"type":"string","title":"Product type","examples":["EDR","EPP","IR"]},"os_type":{"type":"string","title":"OS type","examples":["WORKSTATION","SERVER"]},"os_platform":{"type":"string","title":"Operation system platform","examples":["Windows"]},"machine_count":{"type":"integer","title":"Count of machines having this product"}}}}}}}}}}}}},"tags":["V2 (RMM) Accounts"],"operationId":"api.rmm.post.accounts"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["account.view","sites.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Accounts response schema","description":"The expected response when getting all accounts","properties":{"accounts":{"title":"Accounts response schema","description":"The expected response when getting all accounts","type":"array","items":{"type":"object","title":"Your license key","properties":{"license_key":{"type":"string","title":"The license key associated with the account"},"id":{"type":"string","title":"The id of the account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"The Name of the account"},"options":{"type":"object","title":"Optional field options. Information for MSP.","properties":{"msp":{"type":"object","title":"MSP","properties":{"name":{"type":"string","title":"Name"},"redirect_url":{"type":"string","title":"Redirect URL"}}}}},"account_token":{"type":"string","title":"the account token of this account for registering endpoints"},"client_id":{"type":"string","title":"The default client_id for this account, if any"},"default_policy_id":{"type":"string","title":"The policy ID associated with this account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"default_group_id":{"type":"string","title":"The group ID associated with this account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"owner_id":{"type":"string","format":"uuid","title":"The nebula account owner user ID"},"created_at":{"type":"string","title":"When this account has been created (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"updated_at":{"type":"string","title":"When the account has been updated the last time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"product_license_info":{"type":"array","title":"Product license information","items":{"type":"object","properties":{"licensed_product":{"type":"string","title":"Licensed product","description":"The licensed products","default":"","examples":["MBAE-B,MBAM-B,MBBR-B,MBFT-B,MBRX-B,NCCA-B,NCEP-B,NCRM-B"]},"combo_code":{"type":"string","title":"Combo code","examples":["NEBULA-EP-COMBO"]},"catalog_code":{"type":"string","title":"Catalog code","default":"","examples":["BUS-CLOUD-EPP-01"]},"licensed_seats":{"type":"integer","title":"The number of seats licensed","default":0,"examples":[5]},"license_expires_at":{"type":"string","title":"When the license expires","default":"","examples":["2021-03-18T00:00:00Z"]},"license_term_type":{"type":"string","title":"The License_term_type Schema","default":"","examples":["utility"]},"licensed_ir_remediations":{"type":"integer","title":"Licensed ir remediations","default":0,"examples":[0]},"license_status":{"type":"string","title":"License status","default":"","examples":["active"]},"ir_remediations_count":{"type":"integer","title":"Ir remediations count","default":0,"examples":[0]},"machine_counts":{"type":"array","title":"Endpoints linked to products","items":{"type":"object","title":"Items","properties":{"product_type":{"type":"string","title":"Product type","examples":["EDR","EPP","IR"]},"os_type":{"type":"string","title":"OS type","examples":["WORKSTATION","SERVER"]},"os_platform":{"type":"string","title":"Operation system platform","examples":["Windows"]},"machine_count":{"type":"integer","title":"Count of machines having this product"}}}}}}}}}}}}}}}},"tags":["V2 (RMM) Accounts"],"operationId":"api.rmm.get.accounts"}},"/api/v2/rmm/accounts/{account_id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["account.manage","sites.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Accounts"],"operationId":"api.rmm.delete.accounts"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["account.view","sites.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Your license key","properties":{"license_key":{"type":"string","title":"The license key associated with the account"},"id":{"type":"string","title":"The id of the account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"The Name of the account"},"options":{"type":"object","title":"Optional field options. Information for MSP.","properties":{"msp":{"type":"object","title":"MSP","properties":{"name":{"type":"string","title":"Name"},"redirect_url":{"type":"string","title":"Redirect URL"}}}}},"account_token":{"type":"string","title":"the account token of this account for registering endpoints"},"client_id":{"type":"string","title":"The default client_id for this account, if any"},"default_policy_id":{"type":"string","title":"The policy ID associated with this account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"default_group_id":{"type":"string","title":"The group ID associated with this account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"owner_id":{"type":"string","format":"uuid","title":"The nebula account owner user ID"},"created_at":{"type":"string","title":"When this account has been created (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"updated_at":{"type":"string","title":"When the account has been updated the last time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"product_license_info":{"type":"array","title":"Product license information","items":{"type":"object","properties":{"licensed_product":{"type":"string","title":"Licensed product","description":"The licensed products","default":"","examples":["MBAE-B,MBAM-B,MBBR-B,MBFT-B,MBRX-B,NCCA-B,NCEP-B,NCRM-B"]},"combo_code":{"type":"string","title":"Combo code","examples":["NEBULA-EP-COMBO"]},"catalog_code":{"type":"string","title":"Catalog code","default":"","examples":["BUS-CLOUD-EPP-01"]},"licensed_seats":{"type":"integer","title":"The number of seats licensed","default":0,"examples":[5]},"license_expires_at":{"type":"string","title":"When the license expires","default":"","examples":["2021-03-18T00:00:00Z"]},"license_term_type":{"type":"string","title":"The License_term_type Schema","default":"","examples":["utility"]},"licensed_ir_remediations":{"type":"integer","title":"Licensed ir remediations","default":0,"examples":[0]},"license_status":{"type":"string","title":"License status","default":"","examples":["active"]},"ir_remediations_count":{"type":"integer","title":"Ir remediations count","default":0,"examples":[0]},"machine_counts":{"type":"array","title":"Endpoints linked to products","items":{"type":"object","title":"Items","properties":{"product_type":{"type":"string","title":"Product type","examples":["EDR","EPP","IR"]},"os_type":{"type":"string","title":"OS type","examples":["WORKSTATION","SERVER"]},"os_platform":{"type":"string","title":"Operation system platform","examples":["Windows"]},"machine_count":{"type":"integer","title":"Count of machines having this product"}}}}}}}}}}}}},"tags":["V2 (RMM) Accounts"],"operationId":"api.rmm.get.accounts.id"}},"/api/v2/rmm/accounts/{account_id}/ad/structure":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","patternProperties":{"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$":{"type":"object","properties":{"filter":{"type":"string","description":"Filter string"},"nodes":{"type":"object","additionalProperties":true}}}}}}}}},"tags":["V2 (RMM) Accounts"],"operationId":"api.rmm.get.accounts.ad.structure"}},"/api/v2/rmm/accounts/{account_id}/children":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["account.view","sites.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"description":"Search child accounts API response schema","type":"object","properties":{"results":{"type":"array","items":{"type":"object","title":"Your license key","properties":{"license_key":{"type":"string","title":"The license key associated with the account"},"id":{"type":"string","title":"The id of the account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"The Name of the account"},"options":{"type":"object","title":"Optional field options. Information for MSP.","properties":{"msp":{"type":"object","title":"MSP","properties":{"name":{"type":"string","title":"Name"},"redirect_url":{"type":"string","title":"Redirect URL"}}}}},"account_token":{"type":"string","title":"the account token of this account for registering endpoints"},"client_id":{"type":"string","title":"The default client_id for this account, if any"},"default_policy_id":{"type":"string","title":"The policy ID associated with this account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"default_group_id":{"type":"string","title":"The group ID associated with this account (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"owner_id":{"type":"string","format":"uuid","title":"The nebula account owner user ID"},"created_at":{"type":"string","title":"When this account has been created (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"updated_at":{"type":"string","title":"When the account has been updated the last time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"product_license_info":{"type":"array","title":"Product license information","items":{"type":"object","properties":{"licensed_product":{"type":"string","title":"Licensed product","description":"The licensed products","default":"","examples":["MBAE-B,MBAM-B,MBBR-B,MBFT-B,MBRX-B,NCCA-B,NCEP-B,NCRM-B"]},"combo_code":{"type":"string","title":"Combo code","examples":["NEBULA-EP-COMBO"]},"catalog_code":{"type":"string","title":"Catalog code","default":"","examples":["BUS-CLOUD-EPP-01"]},"licensed_seats":{"type":"integer","title":"The number of seats licensed","default":0,"examples":[5]},"license_expires_at":{"type":"string","title":"When the license expires","default":"","examples":["2021-03-18T00:00:00Z"]},"license_term_type":{"type":"string","title":"The License_term_type Schema","default":"","examples":["utility"]},"licensed_ir_remediations":{"type":"integer","title":"Licensed ir remediations","default":0,"examples":[0]},"license_status":{"type":"string","title":"License status","default":"","examples":["active"]},"ir_remediations_count":{"type":"integer","title":"Ir remediations count","default":0,"examples":[0]},"machine_counts":{"type":"array","title":"Endpoints linked to products","items":{"type":"object","title":"Items","properties":{"product_type":{"type":"string","title":"Product type","examples":["EDR","EPP","IR"]},"os_type":{"type":"string","title":"OS type","examples":["WORKSTATION","SERVER"]},"os_platform":{"type":"string","title":"Operation system platform","examples":["Windows"]},"machine_count":{"type":"integer","title":"Count of machines having this product"}}}}}}}}}},"total_hits":{"type":"integer","description":"Total number of child accounts found"}}}}}}},"tags":["V2 (RMM) Accounts"],"operationId":"api.rmm.post.accounts.id.children"}},"/api/v2/rmm/accounts/{account_id}/secret":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tamperProtection.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Account secret","required":["secret"],"properties":{"secret":{"type":"string","description":"Account secret"}}}}}}},"tags":["V2 (RMM) Accounts"],"operationId":"api.rmm.accounts.get.secret"},"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["tamperProtection.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Set account secret request","required":["secret"],"properties":{"secret":{"type":"string","description":"Account secret to set"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Account secret","required":["secret"],"properties":{"secret":{"type":"string","description":"Account secret"}}}}}}},"tags":["V2 (RMM) Accounts"],"operationId":"api.rmm.accounts.set.secret"}},"/api/v2/rmm/accounts/{account_id}/secrets":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["tamperProtection.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Accounts' secrets","patternProperties":{"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$":{"type":["object","null"],"properties":{"hash":{"type":"string","description":"The hash of the secret"},"updated_at":{"type":"string","description":"Date when the secret was last updated"},"updated_by":{"type":"string","description":"User who last updated the secret"}}}}}}}}},"tags":["V2 (RMM) Accounts"],"operationId":"api.rmm.accounts.get.secrets"}},"/api/v2/rmm/accounts/secrets":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["tamperProtection.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Set account secrets bulk request","required":["secrets"],"properties":{"secrets":{"type":"array","items":{"type":"object","properties":{"secret":{"type":"string","description":"Account secret to set"},"account_id":{"type":"string","description":"Account ID"}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Bulk account secrets set response","type":"object","properties":{"successes":{"type":"array","items":{"type":"string","description":"Account ID"}},"errors":{"type":"array","items":{"type":"string","description":"Account ID"}}}}}}}},"tags":["V2 (RMM) Accounts"],"operationId":"api.rmm.accounts.set.secrets.bulk"}},"/api/v2/rmm/accounts/{account_id}/flight-recorder/chart":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder chart request","required":["advanced_filters"],"oneOf":[{"required":["time_range"]},{"required":["time_window"]}],"properties":{"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"]},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date","format":"date-time"},"lte":{"type":"string","title":"Time window lower than or equal to date","format":"date-time"}}},"advanced_filters":{"type":"array","title":"Advanced flight recorder filters","items":{"items":{"type":"object","properties":{"or":{"type":"array","title":"Filter with or","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}},"and":{"type":"array","title":"Filter with and","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}}}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"array","title":"Flight Recorder chart result","items":{"type":"object","title":"Collection items","properties":{"date":{"type":"string","title":"Date","examples":["2020-06-01T07:00:00.000Z"]},"bucket":{"type":"integer","title":"Bucket"},"process":{"type":"integer","title":"Process"},"filesystem":{"type":"integer","title":"Filesystem"},"script_activity":{"type":"integer","title":"script_activity"},"network":{"type":"integer","title":"Network"},"registry":{"type":"integer","title":"Registry"},"system_event":{"type":"integer","title":"System event"},"other":{"type":"integer","title":"Other"}}}}}}}},"tags":["V2 (RMM) Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.chart"}},"/api/v2/rmm/accounts/{account_id}/flight-recorder/endpoints":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder endpoints request","oneOf":[{"required":["time_range"]},{"required":["time_window"]}],"properties":{"advanced_filters":{"type":"array","title":"Advanced flight recorder filters. REQUIRED field","items":{"items":{"type":"object","properties":{"or":{"type":"array","title":"Filter with or","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}},"and":{"type":"array","title":"Filter with and","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}}}}}},"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"]},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date","format":"date-time"},"lte":{"type":"string","title":"Time window lower than or equal to date","format":"date-time"}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder endpoints result","properties":{"results":{"type":"array","title":"Results","items":{"type":"object","title":"Result items","properties":{"event_categories":{"type":"object","title":"Event categories","properties":{"process":{"type":"integer","title":"Process"},"registry":{"type":"integer","title":"Registry"},"network":{"type":"integer","title":"Network"},"filesystem":{"type":"integer","title":"Filesystem"}}},"first_timestamp":{"type":"string","title":"Seen earliest","examples":["2020-06-01T09:52:10.579Z"]},"last_timestamp":{"type":"string","title":"Seen latest","examples":["2020-06-01T09:52:10.579Z"]},"pc_hostname":{"type":"string","title":"Hostname of PC"},"machine_id":{"type":"string","title":"Endpoint ID","examples":["aff7bb09-4515-4043-a40c-16f2f5a7b9b4"]},"os_type":{"type":"string","title":"OS type","examples":["Windows"]}}}},"total":{"type":"integer","title":"Total"}}}}}}},"tags":["V2 (RMM) Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.endpoints"}},"/api/v2/rmm/accounts/{account_id}/flight-recorder/processes":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder processes request","oneOf":[{"required":["time_range"]},{"required":["time_window"]}],"properties":{"advanced_filters":{"type":"array","title":"Advanced flight recorder filters","items":{"items":{"type":"object","properties":{"or":{"type":"array","title":"Filter with or","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}},"and":{"type":"array","title":"Filter with and","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}}}}}},"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"]},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date","format":"date-time"},"lte":{"type":"string","title":"Time window lower than or equal to date","format":"date-time"}}},"event_category":{"type":"string","enum":["process","filesystem","registry","network","script activity","system event"],"title":"Event's type category filter. Can be one of process, filesystem, registry, network"},"first_activity_gte":{"type":"string","title":"Filter by first activity gte"},"first_activity_lte":{"type":"string","title":"Filter by first activity lte"},"last_activity_gte":{"type":"string","title":"Filter by last activity gte"},"last_activity_lte":{"type":"string","title":"Filter by last activity lte"},"machine_id":{"type":"string","title":"Filter by machine id"},"md5":{"type":"string","title":"Filter by md5"},"os_type":{"type":"string","title":"Filter by machine id"},"pc_hostname":{"type":"string","title":"Filter by os type"},"pid":{"type":"string","title":"Filter by pid"},"pid_version":{"type":"string","title":"Filter by pid version"},"process_name":{"type":"string","title":"Filter by process name"},"process_path":{"type":"string","title":"Filter by process path"},"sha1":{"type":"string","title":"Filter by sha1"},"sha256":{"type":"string","title":"Filter by sha256"},"sha512":{"type":"string","title":"Filter by sha512"},"user":{"type":"string","title":"Filter by user"},"sort":{"type":"object","title":"Choose sort field and type","anyOf":[{"properties":{"first_seen":{"type":"string","enum":["desc","asc"]}}},{"properties":{"last_seen":{"type":"string","enum":["desc","asc"]}}},{"properties":{"os_type":{"type":"string","enum":["desc","asc"]}}},{"properties":{"pc_hostname":{"type":"string","enum":["desc","asc"]}}},{"properties":{"process_path":{"type":"string","enum":["desc","asc"]}}},{"properties":{"user":{"type":"string","enum":["desc","asc"]}}}]}},"page":{"type":"integer","minimum":1,"title":"Page number"},"page_size":{"type":"integer","minimum":1,"maximum":2000,"title":"Page size"}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder processes result","properties":{"results":{"type":"array","title":"Results","items":{"type":"object","title":"Result items","properties":{"event_categories":{"type":"object","title":"Event categories","properties":{"network":{"type":"integer","title":"Network"},"process":{"type":"integer","title":"Process"},"registry":{"type":"integer","title":"Registry"},"script_activity":{"type":"integer","title":"Script Activity"},"system_event":{"type":"integer","title":"System Event"},"other":{"type":"integer","title":"Other"}}},"first_activity":{"type":"string","title":"Seen earliest","examples":["2020-06-01T09:52:10.579Z"]},"last_activity":{"type":"string","title":"Seen latest","examples":["2020-06-01T09:52:10.579Z"]},"machine_id":{"type":"string","title":"Machine Id"},"pid":{"type":"string","title":"Process Id"},"pid_version":{"type":"string","title":"Process Id version"},"process_path":{"type":"string","title":"Process path"},"md5":{"type":"string","title":"md5"},"sha1":{"type":"string","title":"sha1"},"sha256":{"type":["string","null"],"title":"sha256"},"sha512":{"type":"string","title":"sha512"},"user":{"type":"string","title":"user"}}}},"total":{"type":"integer","title":"Total"}}}}}}},"tags":["V2 (RMM) Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.processes"}},"/api/v2/rmm/accounts/{account_id}/flight-recorder/recap":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder recap request","required":["input_value"],"oneOf":[{"required":["time_range"]},{"required":["time_window"]}],"properties":{"input_value":{"type":"string","title":"Input value"},"advanced_filters":{"type":"array","title":"Advanced flight recorder filters. REQUIRED field","items":{"items":{"type":"object","properties":{"or":{"type":"array","title":"Filter with or","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}},"and":{"type":"array","title":"Filter with and","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}}}}}},"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"]},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date","format":"date-time"},"lte":{"type":"string","title":"Time window lower than or equal to date","format":"date-time"}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder recap result","properties":{"endpoints":{"type":"integer","title":"The endpoints schema"},"last_seen":{"type":"object","title":"Seen latest","properties":{"timestamp":{"type":"string","title":"Timestamp","examples":["2020-06-01T09:52:10.579Z"]},"machine_id":{"type":"string","title":"Endpoint ID","examples":["aff7bb09-4515-4043-a40c-16f2f5a7b9b4"]},"pc_hostname":{"type":"string","title":"Hostname of PC"}}},"first_seen":{"type":"object","title":"Seen earliest","properties":{"timestamp":{"type":"string","title":"Timestamp","examples":["2020-06-01T09:52:10.579Z"]},"machine_id":{"type":"string","title":"Machine ID","examples":["aff7bb09-4515-4043-a40c-16f2f5a7b9b4"]},"pc_hostname":{"type":"string","title":"Hostname of PC"}}}}}}}}},"tags":["V2 (RMM) Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.recap"}},"/api/v2/rmm/accounts/{account_id}/flight-recorder/search":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder search request","required":["advanced_filters"],"examples":[{"time_range":"7d","advanced_filters":[{"or":[{"and":[{"eq":["process_name","explorer.exe"]},{"eq":["pc_hostname","Bob-Pc"]}]},{"and":[{"eq":["pc_hostname","Alice-PC"]},{"eq":["process_name","explorer.exe"]}]}]}]}],"oneOf":[{"required":["time_range"]},{"required":["time_window"]}],"properties":{"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"]},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date","format":"date-time"},"lte":{"type":"string","title":"Time window lower than or equal to date","format":"date-time"}}},"pc_hostname":{"type":"string","title":"Hostname filter"},"event_category":{"type":"string","title":"Event category filter","enum":["network","filesystem","proccess","registry","script activity"]},"advanced_filters":{"type":"array","title":"Advanced flight recorder filters","items":{"items":{"type":"object","properties":{"or":{"type":"array","title":"Filter with or","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}},"and":{"type":"array","title":"Filter with and","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}}}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder processes result","properties":{"results":{"type":"array","title":"Results","items":{"type":"object","title":"Result items","properties":{"event_categories":{"type":"object","title":"Event categories","properties":{"network":{"type":"integer","title":"Network"},"process":{"type":"integer","title":"Process"},"registry":{"type":"integer","title":"Registry"},"script_activity":{"type":"integer","title":"Script Activity"},"system_event":{"type":"integer","title":"System Event"},"other":{"type":"integer","title":"Other"}}},"first_activity":{"type":"string","title":"Seen earliest","examples":["2020-06-01T09:52:10.579Z"]},"last_activity":{"type":"string","title":"Seen latest","examples":["2020-06-01T09:52:10.579Z"]},"machine_id":{"type":"string","title":"Machine Id"},"pid":{"type":"string","title":"Process Id"},"pid_version":{"type":"string","title":"Process Id version"},"process_path":{"type":"string","title":"Process path"},"md5":{"type":"string","title":"md5"},"sha1":{"type":"string","title":"sha1"},"sha256":{"type":["string","null"],"title":"sha256"},"sha512":{"type":"string","title":"sha512"},"user":{"type":"string","title":"user"}}}},"total":{"type":"integer","title":"Total"}}}}}}},"tags":["V2 (RMM) Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.search"}},"/api/v2/rmm/accounts/{account_id}/flight-recorder/process_graph":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder process_graph request","required":["pid","path","machine_id"],"properties":{"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"],"default":"7d"},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date"},"lte":{"type":"string","title":"Time window lower than or equal to date"}}},"account_id":{"type":"string","title":"Account Id"},"machine_id":{"type":"string","title":"Machine id"},"pid":{"type":"string","title":"Process Id"},"path":{"type":"string","title":"Process path"},"pid_version":{"type":"string","title":"Process Id version filter","default":0},"os_type":{"type":"string","title":"Os Type filter","default":"Windows"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder process_graph result","properties":{"id":{"type":"string","title":"Id"},"name":{"type":"string","title":"Name"},"node_type":{"type":"string","title":"Node type"},"children":{"type":"array","title":"The Children nodes","items":{"type":"object","title":"The Children node, recursive structure","properties":{"id":{"type":"string","title":"id"},"name":{"type":"string","title":"Name"},"edge_info":{"type":"object","description":"Edge Info","properties":{"command_line":{"type":"string","title":"Command line"},"timestamp":{"type":"string","format":"date-time","title":"Timestamp"},"relation":{"type":"string","title":"Relation"}}},"node_type":{"type":"string","title":"Node type"},"node_info":{"type":"object","title":"Node info","properties":{"activities":{"type":"array","title":"Activities"},"process_id":{"type":"string","title":"Process Id"},"dropped":{"type":"boolean","title":"Dropped"},"process_path":{"type":"string","title":"Process Path"},"main_node":{"type":"boolean","title":"Main Node"}}}}}},"node_info":{"type":"object","title":"Node metadata","additionalProperties":true},"edge_info":{"type":"object","title":"Edge node info","additionalProperties":true}}}}}}},"tags":["V2 (RMM) Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.process_graph"}},"/api/v2/rmm/accounts/{account_id}/flight-recorder/raw_events":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder raw_events request","required":["machine_id","pid","pid_version","path","event_type","first_activity","last_activity"],"properties":{"machine_id":{"type":"string","title":"Machine id"},"pid":{"type":"string","title":"Process Id filter"},"pid_version":{"type":"string","title":"Process Id version filter"},"path":{"type":"string","title":"Process Path"},"event_type":{"type":"string","enum":["ANTIMALWARE_SCAN","FILE_DELETE","FILE_READ","FILE_RENAME","FILE_SET_INFORMATION","FILE_WRITE","NET_CONNECT_INBOUND","NET_CONNECT_INBOUND_PRIVATE","NET_CONNECT_OUTBOUND","NET_CONNECT_OUTBOUND_PRIVATE","REG_QUERY_VALUE","REG_SET_VALUE","SYSTEM_CALL","SYSTEM_EVENT","WIN_LOG"],"title":"Raw event's type filter"},"first_activity":{"type":"string","title":"Initial date","format":"date-time"},"last_activity":{"type":"string","title":"Last date","format":"date-time"},"page":{"type":"integer","minimum":1,"title":"Page number"},"page_size":{"type":"integer","minimum":1,"title":"Page size"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder raw_events result","properties":{"results":{"type":"array","title":"Results","items":{"type":"object","properties":{"account_id":{"type":"string","title":"Account Id"},"amsi_data":{"type":"string","title":"Amsi data"},"amsi_data_type":{"type":"string","title":"Amsi data type"},"command_line":{"type":"string","title":"Command line"},"create_options":{"type":"string","title":"Create Options"},"etw_data":{"type":"string","title":"Etw data"},"event_category":{"type":"string","title":"Event Category"},"event_type":{"type":"string","title":"Event type"},"evt_log_data":{"type":"string","title":"Event log data"},"hostname":{"type":"string","title":"Hostname"},"machine_id":{"type":"string","title":"Machine id"},"ipv4_local_ip":{"type":"string","title":"IPv4 local IP"},"ipv4_remote_country_code":{"type":"string","title":"IPv4 remote country code"},"ipv4_remote_ip":{"type":"string","title":"IPv4 remote IP"},"ipv6_local_ip":{"type":"string","title":"IPv6 local IP"},"ipv6_remote_country_code":{"type":"string","title":"IPv6 remote country code"},"ipv6_remote_ip":{"type":"string","title":"IPv6 remote IP"},"local_port":{"type":"string","title":"Local port"},"new_name":{"type":"string","title":"New name"},"new_path":{"type":"string","title":"New path"},"new_process_id":{"type":"string","title":"New process id"},"object_name":{"type":"string","title":"Object name"},"object_path":{"type":"string","title":"Object path"},"process_name":{"type":"string","title":"Process name"},"protocol":{"type":"string","title":"Protocol"},"registry_data":{"type":"string","title":"Registry data"},"registry_data_type":{"type":"string","title":"Registry data type"},"registry_key":{"type":"string","title":"Registry key"},"registry_value":{"type":"string","title":"Registry value"},"remote_port":{"type":"string","title":"Remote port"},"sha256":{"type":"string","title":"SHA256"},"stream_id":{"type":"string","title":"Stream id"},"winlog_event_id":{"type":"string","title":"Winlog event id"},"timestamp":{"type":"string","title":"Timestamp"}}}},"total":{"type":"integer","title":"Total"}}}}}}},"tags":["V2 (RMM) Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.raw_events"}},"/api/v2/rmm/accounts/{account_id}/sa":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"sort_field","required":false,"in":"query","description":"Sort field","schema":{"type":"string","enum":["timestamp","level","pc_hostname"]}},{"name":"sort_direction","required":false,"in":"query","description":"Sort direction","schema":{"type":"string","enum":["asc","desc"]}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"Since (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$"}},{"name":"before","required":false,"in":"query","description":"Before (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$"}},{"name":"group_ids","required":false,"in":"query","description":"Group ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":["string","array"],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"per_page","required":false,"in":"query","description":"Page size","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Suspicious activity response","required":["sa","total_count"],"properties":{"sa":{"type":"array","title":"Suspicious activity","items":{"type":"object","title":"Suspicious activity items","additionalProperties":true,"properties":{"detection_id_list":{"type":"array","title":"List of detections IDs","items":{"type":"number"}},"status":{"type":"string","title":"Status"},"timestamp":{"type":"string","title":"Timestamp"},"path":{"type":"string","title":"Path"},"pc_hostname":{"type":"string","title":"Hostname of PC"},"machine_id":{"type":"string","title":"placeholder"},"account_id":{"type":"string","title":"Account ID"},"closed":{"type":"integer","title":"Closed"},"level":{"type":"integer","title":"Level"},"detected_by_count":{"type":"integer","title":"Count"}}}},"total_count":{"type":"integer","title":"Total count"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Sa"],"operationId":"api.rmm.get.suspiciousactivity"}},"/api/v2/rmm/accounts/{account_id}/sa/{id}/process_graph":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Valid Account UUID","schema":{"type":"string"}},{"name":"id","required":true,"in":"path","description":"ID of suspicious activity","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Process graph of suspicious activity","additionalProperties":true,"properties":{"data":{"type":"object","title":"Data","additionalProperties":true,"properties":{"node_type":{"type":"string","title":"Node type"},"children":{"type":"array","title":"Children of this node","default":[],"additionalItems":true,"items":{"type":"object","title":"Items of childres","additionalProperties":true,"properties":{"id":{"type":"string","title":"ID"},"name":{"type":"string","title":"Name","examples":["EXPLORER.EXE"]},"node_type":{"type":"string","title":"Node type","examples":["Process"]},"children":{"type":"array","title":"Children of this node. Follows the same structure as current node.","additionalItems":true,"items":{"type":"object","title":"Children items","additionalProperties":true}},"node_info":{"type":"object","title":"Node info","additionalProperties":true,"properties":{"activities":{"type":"array","title":"Activities","default":[],"items":{"type":"object","title":"Activities items","additionalProperties":true},"additionalItems":true},"process_id":{"type":"integer","title":"Process id - PID","examples":[5696]},"dropped":{"type":"boolean","title":"Dropped"},"process_path":{"type":"string","title":"Process path","examples":["C:\\WINDOWS\\EXPLORER.EXE"]}}}}}},"name":{"type":"string","title":"Name","examples":["START"]},"id":{"type":"string","title":"ID","examples":["-"]}}}}}}}}},"tags":["V2 (RMM) Sa"],"operationId":"api.rmm.get.suspiciousactivity.process_graph"}},"/api/v2/rmm/accounts/{account_id}/sa/close":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Payload to open/close a suspicious activity","properties":{"account_id":{"type":"string","title":"Account ID of the Site on which execute command (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id_list":{"type":"array","title":"Array of integers indicating the detections on which execute remediation","items":{"type":"integer"}},"machine_id":{"type":"string","title":"ID of the machine on which execute command (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"user_email":{"type":"string","title":"Email of user executing command"},"user_id":{"type":"string","title":"ID of user executing command"},"username":{"type":"string","title":"Email of who's executing command"}},"required":["account_id","detection_id_list","machine_id","user_email","user_id","username"]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Sa"],"operationId":"api.rmm.post.sa.close"}},"/api/v2/rmm/accounts/{account_id}/sa/details":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Suspicious activity request payload","required":["detection_id_list","endpoint"],"properties":{"detection_id_list":{"type":"array","title":"List of Suspicious Activity IDs","items":{"type":"integer","title":"Suspicious Activity IDs","examples":[274304,7874825]}},"endpoint":{"type":"string","title":"UUID of the endpoint","examples":["3fdbe4c1-8a80-4a57-8369-9ec4399fbf0b"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Details of suspicious activities","additionalProperties":true,"properties":{"data":{"type":"object","title":"The Details Schema","additionalProperties":true,"properties":{"resolved":{"type":["null","string","number"],"title":"The Resolved Schema"},"pc_hostname":{"type":"string","title":"Hostname of PC"},"status":{"type":"string","title":"Status"},"tot":{"type":"integer","title":"Count of suspicious activities"},"list":{"type":"array","title":"List of suspicious activities","additionalItems":true,"items":{"type":"object","title":"List items","additionalProperties":true,"properties":{"status":{"type":"string","title":"Status","examples":["detected"]},"timestamp":{"type":"string","title":"Timestamp"},"path":{"type":"string","title":"Path","examples":["C:\\WINDOWS\\SYSTEM32\\CMD.EXE"]},"detection_id":{"type":"integer","title":"Id of the suspicious activity"},"details":{"type":"array","title":"Collection of details about suspicious activity","additionalItems":true,"items":{"type":"object","title":"Detail items","additionalProperties":true,"properties":{"timestamp":{"type":"string","title":"Timestamp","examples":["2020-03-25 14:56:12"]},"path":{"type":"string","title":"Path","examples":["C:\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE"]},"detected_by":{"type":"array","title":"Detected by collection","additionalItems":true,"items":{"type":"object","title":"Detected by items","additionalProperties":true,"properties":{"description":{"type":"string","title":"Description","examples":["A suspicious script has been executed by Powershell"]},"verbose":{"type":"string","title":"Verbose Description","examples":["A suspicious script has been executed by Powershell"]},"tag":{"type":"string","title":"Tag","examples":["powershell scripting activity"]},"content":{"type":"array","title":"The Content Schema","default":[],"examples":[[{"launched_proc":"POWERSHELL.EXE","hash":{"Sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","Sha1":"36c5d12033b2eaf251bae61c00690ffb17fddc87","Md5":"cda48fc75952ad12d99e526d0b6bf70a","Sha512":"31946a5c80088646fe951081e88a7478b804da874236a44e845842404c9770450c9b1ac3bb1af2b00b0102fe4983b5728fe4df8c40d28f9bef16230a28ae5df0"},"command_line":"\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -windowstyle hidden -File \"C:\\Program Files\\EAWindowsTool\\EAWindowsTool.ps1 "}]],"additionalItems":true,"items":{"type":"object","title":"The Items Schema","additionalProperties":true,"properties":{"command_line":{"type":"string","title":"Command line","examples":["\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -windowstyle hidden -File \"C:\\Program Files\\EAWindowsTool\\EAWindowsTool.ps1 "]},"hash":{"type":"object","title":"Hashes","additionalProperties":true,"properties":{"Md5":{"type":"string","title":"Md5"},"Sha1":{"type":"string","title":"Sha1","examples":["36c5d12033b2eaf251bae61c00690ffb17fddc87"]},"Sha256":{"type":"string","title":"Sha256","examples":["908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53"]},"Sha512":{"type":"string","title":"Sha512","examples":["31946a5c80088646fe951081e88a7478b804da874236a44e845842404c9770450c9b1ac3bb1af2b00b0102fe4983b5728fe4df8c40d28f9bef16230a28ae5df0"]}}},"launched_proc":{"type":"string","title":"Launched process","examples":["POWERSHELL.EXE"]}}}},"level":{"type":"integer","title":"Level"}}}},"pid":{"type":"integer","title":"Process ID"}}}},"pid":{"type":"integer","title":"Process ID"}}}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Sa"],"operationId":"api.rmm.get.suspiciousactivity.details"}},"/api/v2/rmm/accounts/{account_id}/sa/open":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Payload to open/close a suspicious activity","properties":{"account_id":{"type":"string","title":"Account ID of the Site on which execute command (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id_list":{"type":"array","title":"Array of integers indicating the detections on which execute remediation","items":{"type":"integer"}},"machine_id":{"type":"string","title":"ID of the machine on which execute command (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"user_email":{"type":"string","title":"Email of user executing command"},"user_id":{"type":"string","title":"ID of user executing command"},"username":{"type":"string","title":"Email of who's executing command"}},"required":["account_id","detection_id_list","machine_id","user_email","user_id","username"]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Sa"],"operationId":"api.rmm.post.sa.open"}},"/api/v2/rmm/accounts/{account_id}/sa/remediate":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Remediate suspicious activity on endpoint","properties":{"correlation_id":{"type":"string","title":"ID of the correlation for task creation (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id_list":{"type":"array","title":"Array of integers indicating the detections on which execute remediation","items":{"type":"integer"}},"machine_id":{"type":"string","title":"ID of the machine on which execute command (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"required":["correlation_id","detection_id_list","machine_id"]}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The eagle remediate schema","properties":{"job_id":{"type":["string","null"],"title":"ID of the remediation job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["V2 (RMM) Sa"],"operationId":"api.rmm.post.sa.remediate"}},"/api/v2/rmm/notifications/subscriptions/change-owner":{"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.editOthers"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"change notification owner request","allOf":[{"type":"object","title":"change notification owner request","required":["subscriptions","owner"],"properties":{"subscriptions":{"type":"array","minLength":1,"items":{"type":"string","title":"notification ID","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},"owner":{"title":"the new owner of the subscription","type":"string"}}},{"required":["parent_account_id"],"properties":{"parent_account_id":{"title":"the subscriptions' account_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}}]}}}},"responses":{"202":{"description":"response schema","content":{"application/json":{}}}},"tags":["V2 (RMM) Notifications"],"operationId":"api.v2.rmm.change-owner.notification"}},"/api/v2/rmm/notifications/subscriptions":{"post":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.createOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Schema For Notifications Creation","properties":{"parent_account_id":{"type":"string","title":"Nebula Parent Account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\").","description":"If this is specified, all the events from the child account_ids will be included. In that case, account_ids is not required","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"anyOf":[{"required":["account_ids"]},{"required":["parent_account_id"]}],"allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]}],"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_verified","oneview_user_deleted","oneview_sites_assigned","oneview_trial_to_paid_status","oneview_site_end_date_approaching"]}}},"then":{"required":["parent_account_id"]}}}}},"responses":{"202":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"RMM notification response","allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"},"owner":{"title":"Notification owner","type":"string"},"account_id":{"title":"Account Id of the owner of the notification","type":"string"},"created_at":{"title":"Created at timestamp","format":"date-time"},"updated_at":{"title":"Updated at timestamp","format":"date-time"},"created_by":{"title":"Created by","type":"string"},"updated_by":{"title":"Created by","type":"string"}}}]}}}}},"tags":["V2 (RMM) Notifications"],"operationId":"api.v2.rmm.post.notification"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["notifications.viewOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","description":"The page_size Schema","schema":{"type":"string","pattern":"^(?:[1-9][0-9]{0,2}|1[0-9]{3}|2000)$"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"only_current_owner","required":false,"in":"query","description":"if true, only the notifications subscriptions owned by the requester will be returned","schema":{"type":"boolean"}},{"name":"parent_account_id","required":false,"in":"query","description":"the subscriptions' account_id. This is required to access notifications subscriptions for a different owner, but in the same account (requires super admin permission).","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The get all notification Body","required":["records","next_cursor"],"properties":{"records":{"type":"array","items":{"type":"object","title":"RMM notification response","allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"},"owner":{"title":"Notification owner","type":"string"},"account_id":{"title":"Account Id of the owner of the notification","type":"string"},"created_at":{"title":"Created at timestamp","format":"date-time"},"updated_at":{"title":"Updated at timestamp","format":"date-time"},"created_by":{"title":"Created by","type":"string"},"updated_by":{"title":"Created by","type":"string"}}}]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Notifications"],"operationId":"api.v2.rmm.get-all.notification"}},"/api/v2/rmm/notifications/subscriptions/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.deleteOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"parent_account_id","required":false,"in":"query","description":"the subscriptions' account_id. This is required to access notifications subscriptions for a different owner, but in the same account (requires super admin permission).","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Notifications"],"operationId":"api.v2.rmm.delete.notification"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["notifications.viewOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"parent_account_id","required":false,"in":"query","description":"the subscriptions' account_id. This is required to access notifications subscriptions for a different owner, but in the same account (requires super admin permission).","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"RMM notification response","allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"},"owner":{"title":"Notification owner","type":"string"},"account_id":{"title":"Account Id of the owner of the notification","type":"string"},"created_at":{"title":"Created at timestamp","format":"date-time"},"updated_at":{"title":"Updated at timestamp","format":"date-time"},"created_by":{"title":"Created by","type":"string"},"updated_by":{"title":"Created by","type":"string"}}}]}}}}},"tags":["V2 (RMM) Notifications"],"operationId":"api.v2.rmm.get.notification"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.editOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Schema For Notifications Creation","properties":{"parent_account_id":{"type":"string","title":"Nebula Parent Account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\").","description":"If this is specified, all the events from the child account_ids will be included. In that case, account_ids is not required","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"anyOf":[{"required":["account_ids"]},{"required":["parent_account_id"]}],"allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]}],"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_verified","oneview_user_deleted","oneview_sites_assigned","oneview_trial_to_paid_status","oneview_site_end_date_approaching"]}}},"then":{"required":["parent_account_id"]}}}}},"responses":{"202":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"RMM notification response","allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"},"owner":{"title":"Notification owner","type":"string"},"account_id":{"title":"Account Id of the owner of the notification","type":"string"},"created_at":{"title":"Created at timestamp","format":"date-time"},"updated_at":{"title":"Updated at timestamp","format":"date-time"},"created_by":{"title":"Created by","type":"string"},"updated_by":{"title":"Created by","type":"string"}}}]}}}}},"tags":["V2 (RMM) Notifications"],"operationId":"api.v2.rmm.put.notification"}},"/api/v2/rmm/notifications/subscriptions/bulk":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.deleteOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"parent_account_id","required":false,"in":"query","description":"the subscriptions' account_id. This is required to access notifications subscriptions for a different owner, but in the same account (requires super admin permission).","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The delete bulk notification Body","required":["subscriptions"],"properties":{"subscriptions":{"type":"array","title":"The subscriptions to delete","minItems":1,"items":{"title":"Subscription to delete","type":"object","required":["id"],"properties":{"id":{"type":"string","title":"Subscription id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Notifications"],"operationId":"api.v2.rmm.delete-bulk.notification"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.editOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The update bulk notification Body","required":["records"],"properties":{"records":{"type":"array","title":"The subscriptions to update","minItems":1,"items":{"allOf":[{"type":"object","title":"The Schema For Notifications Creation","properties":{"parent_account_id":{"type":"string","title":"Nebula Parent Account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\").","description":"If this is specified, all the events from the child account_ids will be included. In that case, account_ids is not required","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"anyOf":[{"required":["account_ids"]},{"required":["parent_account_id"]}],"allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]}],"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_verified","oneview_user_deleted","oneview_sites_assigned","oneview_trial_to_paid_status","oneview_site_end_date_approaching"]}}},"then":{"required":["parent_account_id"]}},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"}}}]}}}}}}},"responses":{"202":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The get all notification Body","required":["records","next_cursor"],"properties":{"records":{"type":"array","items":{"type":"object","title":"RMM notification response","allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"},"owner":{"title":"Notification owner","type":"string"},"account_id":{"title":"Account Id of the owner of the notification","type":"string"},"created_at":{"title":"Created at timestamp","format":"date-time"},"updated_at":{"title":"Updated at timestamp","format":"date-time"},"created_by":{"title":"Created by","type":"string"},"updated_by":{"title":"Created by","type":"string"}}}]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Notifications"],"operationId":"api.v2.rmm.put-bulk.notification"}},"/api/v2/rmm/accounts/{account_id}/notifications/subscriptions/delete-by-owner/{owner}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.deleteOwn","notifications.deleteOthers"]}],"status":{"outage":["auth","webhooks_subscriptions","subscriptions_db"]},"parameters":[{"name":"owner","required":false,"in":"path","description":"Notification owner","schema":{"type":"string"}},{"name":"account_id","required":false,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{}}}},"tags":["V2 (RMM) Notifications"],"operationId":"api.v2.rmm.delete-by-owner.notification"}},"/api/v2/rmm/accounts/{account_id}/notifications/subscriptions/remove-email/{email}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["notifications.editOthers","notifications.editOwn","notifications.deleteOwn","notifications.deleteOthers"]}],"status":{"outage":["auth","webhooks_subscriptions","subscriptions_db"]},"parameters":[{"name":"email","required":false,"in":"path","description":"email","schema":{"type":"string"}},{"name":"account_id","required":false,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{}}}},"tags":["V2 (RMM) Notifications"],"operationId":"api.v2.rmm.remove-email.notification"}},"/api/v2/rmm/accounts/{account_id}/users":{"post":{"security":[{"oauth_ac":["create:accounts"]},{"client_credentials":["create:accounts"]},{"nebula":[]},{"user_permissions":["users.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Nebula user model","description":"Nebula user model","examples":[{"display_name":"Alice Bob","email":"alicebob@malwarebytes.com","role":"SuperAdmin","all_groups_access":true,"group_ids":[]}],"required":["display_name","email","role","all_groups_access","group_ids"],"properties":{"display_name":{"type":"string","title":"User display ame","description":"The display name of the user.","examples":["Alice Bob"]},"ars_permission":{"type":"boolean","title":"ARS permission","description":"ARS permission for the iuser","default":false,"examples":[false]},"email":{"type":"string","title":"Email","description":"Email.","examples":["alicebob@malwarebytes.com"]},"role":{"type":"string","title":"The Role of the user","description":"The role of the user.","enum":["SuperAdmin","Admin","ReadOnlyUser"],"examples":["SuperAdmin"]},"all_groups_access":{"type":"boolean","title":"Whether the user has access to all groups or not (applies to admin and readonly users)","default":false,"examples":[true]},"group_ids":{"type":"array","title":"The group_ids schema","default":[],"additionalItems":true,"items":{"type":"string","title":"Unique identifier of groups to which this user is assigned to"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Nebula user model","description":"Nebula user model","examples":[{"id":"16ea2ecb-bc28-43e2-b66f-9edc48bef56f","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","display_name":"Alice Bob","email":"alicebob@malwarebytes.com","last_login_at":"2018-10-05T15:15:36.116105Z","unconfirmed_email":"","ars_permission":true,"role":"SuperAdmin","impersonation_authorized_until":null,"all_groups_access":true,"group_ids":[],"otp_enabled":false,"otp_recovery_email":"test@gmail.com","otp_recovery_email_status":"Verified"}],"required":["id","account_id","display_name","role","all_groups_access","group_ids"],"properties":{"id":{"type":"string","title":"The id schema","description":"The unique identifier of the user.","default":"","examples":["16ea2ecb-bc28-43e2-b66f-9edc48bef56f"]},"ars_permission":{"type":"boolean","title":"ARS permission","description":"ARS permission for the iuser","default":false,"examples":[false]},"account_id":{"type":"string","title":"The account_id","description":"Account id.","default":"","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"display_name":{"type":"string","title":"User display ame","description":"The display name of the user.","default":"","examples":["Alice Bob"]},"email":{"type":"string","title":"Email","description":"Email.","default":"","examples":["alicebob@malwarebytes.com"]},"last_login_at":{"type":"string","title":"The last time this user logged in","description":"Last login time","default":"","examples":["2018-10-05T15:15:36.116105Z"]},"unconfirmed_email":{"type":"string","title":"Unconfirmed email","description":"Unconfirmed email.","default":"","examples":[""]},"role":{"type":"string","title":"The Role of the user","description":"The role of the user.","enum":["SuperAdmin","Admin","ReadOnlyUser"],"examples":["SuperAdmin"]},"all_groups_access":{"type":"boolean","title":"Whether the user has access to all groups or not (applies to admin and readonly users)","default":false,"examples":[true]},"group_ids":{"type":"array","title":"The group_ids schema","default":[],"additionalItems":true,"items":{"type":"string","title":"Unique identifier of groups to which this user is assigned to"}},"otp_enabled":{"type":"boolean","title":"The otp_enabled schema","description":"Whether OTP is enabled or not.","default":false,"examples":[false]},"otp_recovery_email":{"type":"string","title":"The opt recovery email","description":"The opt recovery email","default":"","examples":["alicebob@malwarebytes.com"]},"otp_recovery_email_status":{"type":"string","title":"The opt recovery email status","description":"The opt recovery email status","default":"AwaitingSetup","examples":["AwaitingSetup","PendingVerification","ExpiredVerification","Verified"]}}}}}}},"tags":["V2 (RMM) Users"],"operationId":"api.rmm.post.users"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["users.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Get users response schema","description":"Get users response schema.","examples":[{"users":[{"id":"16ea2ecb-bc28-43e2-b66f-9edc48bef56f","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","display_name":"Alice Bob","email":"alicebob@malwarebytes.com","last_login_at":"2018-10-05T15:15:36.116105Z","unconfirmed_email":"","role":"SuperAdmin","impersonation_authorized_until":null,"all_groups_access":true,"group_ids":[],"otp_enabled":false,"otp_recovery_email":"test@gmail.com","otp_recovery_email_status":"Verified"}],"total_count":1,"next_cursor":"eyJzdGFydF9pbmRleCI6MTAwfQ=="}],"required":["users","total_count","next_cursor"],"properties":{"users":{"type":"array","title":"List of users","description":"List of users.","items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Nebula user model","description":"Nebula user model","examples":[{"id":"16ea2ecb-bc28-43e2-b66f-9edc48bef56f","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","display_name":"Alice Bob","email":"alicebob@malwarebytes.com","last_login_at":"2018-10-05T15:15:36.116105Z","unconfirmed_email":"","ars_permission":true,"role":"SuperAdmin","impersonation_authorized_until":null,"all_groups_access":true,"group_ids":[],"otp_enabled":false,"otp_recovery_email":"test@gmail.com","otp_recovery_email_status":"Verified"}],"required":["id","account_id","display_name","role","all_groups_access","group_ids"],"properties":{"id":{"type":"string","title":"The id schema","description":"The unique identifier of the user.","default":"","examples":["16ea2ecb-bc28-43e2-b66f-9edc48bef56f"]},"ars_permission":{"type":"boolean","title":"ARS permission","description":"ARS permission for the iuser","default":false,"examples":[false]},"account_id":{"type":"string","title":"The account_id","description":"Account id.","default":"","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"display_name":{"type":"string","title":"User display ame","description":"The display name of the user.","default":"","examples":["Alice Bob"]},"email":{"type":"string","title":"Email","description":"Email.","default":"","examples":["alicebob@malwarebytes.com"]},"last_login_at":{"type":"string","title":"The last time this user logged in","description":"Last login time","default":"","examples":["2018-10-05T15:15:36.116105Z"]},"unconfirmed_email":{"type":"string","title":"Unconfirmed email","description":"Unconfirmed email.","default":"","examples":[""]},"role":{"type":"string","title":"The Role of the user","description":"The role of the user.","enum":["SuperAdmin","Admin","ReadOnlyUser"],"examples":["SuperAdmin"]},"all_groups_access":{"type":"boolean","title":"Whether the user has access to all groups or not (applies to admin and readonly users)","default":false,"examples":[true]},"group_ids":{"type":"array","title":"The group_ids schema","default":[],"additionalItems":true,"items":{"type":"string","title":"Unique identifier of groups to which this user is assigned to"}},"otp_enabled":{"type":"boolean","title":"The otp_enabled schema","description":"Whether OTP is enabled or not.","default":false,"examples":[false]},"otp_recovery_email":{"type":"string","title":"The opt recovery email","description":"The opt recovery email","default":"","examples":["alicebob@malwarebytes.com"]},"otp_recovery_email_status":{"type":"string","title":"The opt recovery email status","description":"The opt recovery email status","default":"AwaitingSetup","examples":["AwaitingSetup","PendingVerification","ExpiredVerification","Verified"]}}}},"total_count":{"type":"integer","title":"The total_count schema","description":"Total count of users.","default":0,"examples":[1]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Users"],"operationId":"api.rmm.get.users"}},"/api/v2/rmm/accounts/{account_id}/users/{id}":{"delete":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["users.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["V2 (RMM) Users"],"operationId":"api.rmm.delete.users"},"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["users.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Nebula user model","description":"Nebula user model","examples":[{"id":"16ea2ecb-bc28-43e2-b66f-9edc48bef56f","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","display_name":"Alice Bob","email":"alicebob@malwarebytes.com","last_login_at":"2018-10-05T15:15:36.116105Z","unconfirmed_email":"","ars_permission":true,"role":"SuperAdmin","impersonation_authorized_until":null,"all_groups_access":true,"group_ids":[],"otp_enabled":false,"otp_recovery_email":"test@gmail.com","otp_recovery_email_status":"Verified"}],"required":["id","account_id","display_name","role","all_groups_access","group_ids"],"properties":{"id":{"type":"string","title":"The id schema","description":"The unique identifier of the user.","default":"","examples":["16ea2ecb-bc28-43e2-b66f-9edc48bef56f"]},"ars_permission":{"type":"boolean","title":"ARS permission","description":"ARS permission for the iuser","default":false,"examples":[false]},"account_id":{"type":"string","title":"The account_id","description":"Account id.","default":"","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"display_name":{"type":"string","title":"User display ame","description":"The display name of the user.","default":"","examples":["Alice Bob"]},"email":{"type":"string","title":"Email","description":"Email.","default":"","examples":["alicebob@malwarebytes.com"]},"last_login_at":{"type":"string","title":"The last time this user logged in","description":"Last login time","default":"","examples":["2018-10-05T15:15:36.116105Z"]},"unconfirmed_email":{"type":"string","title":"Unconfirmed email","description":"Unconfirmed email.","default":"","examples":[""]},"role":{"type":"string","title":"The Role of the user","description":"The role of the user.","enum":["SuperAdmin","Admin","ReadOnlyUser"],"examples":["SuperAdmin"]},"all_groups_access":{"type":"boolean","title":"Whether the user has access to all groups or not (applies to admin and readonly users)","default":false,"examples":[true]},"group_ids":{"type":"array","title":"The group_ids schema","default":[],"additionalItems":true,"items":{"type":"string","title":"Unique identifier of groups to which this user is assigned to"}},"otp_enabled":{"type":"boolean","title":"The otp_enabled schema","description":"Whether OTP is enabled or not.","default":false,"examples":[false]},"otp_recovery_email":{"type":"string","title":"The opt recovery email","description":"The opt recovery email","default":"","examples":["alicebob@malwarebytes.com"]},"otp_recovery_email_status":{"type":"string","title":"The opt recovery email status","description":"The opt recovery email status","default":"AwaitingSetup","examples":["AwaitingSetup","PendingVerification","ExpiredVerification","Verified"]}}}}}}},"tags":["V2 (RMM) Users"],"operationId":"api.rmm.get.user"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["users.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Nebula user model","description":"Nebula user model","examples":[{"role":"SuperAdmin","all_groups_access":true,"group_ids":[]}],"required":["role","all_groups_access","group_ids"],"properties":{"role":{"type":"string","title":"The Role of the user","description":"The role of the user.","enum":["SuperAdmin","Admin","ReadOnlyUser"],"examples":["SuperAdmin"]},"ars_permission":{"type":"boolean","title":"ARS permission","description":"ARS permission for the user","default":false,"examples":[false]},"all_groups_access":{"type":"boolean","title":"Whether the user has access to all groups or not (applies to admin and readonly users)","default":false,"examples":[true]},"group_ids":{"type":"array","title":"The group_ids schema","default":[],"additionalItems":true,"items":{"type":"string","title":"Unique identifier of groups to which this user is assigned to"}},"update_role_across_accounts":{"description":"update the role across all the user accounts","type":"boolean","default":false}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Nebula user model","description":"Nebula user model","examples":[{"id":"16ea2ecb-bc28-43e2-b66f-9edc48bef56f","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","display_name":"Alice Bob","email":"alicebob@malwarebytes.com","last_login_at":"2018-10-05T15:15:36.116105Z","unconfirmed_email":"","ars_permission":true,"role":"SuperAdmin","impersonation_authorized_until":null,"all_groups_access":true,"group_ids":[],"otp_enabled":false,"otp_recovery_email":"test@gmail.com","otp_recovery_email_status":"Verified"}],"required":["id","account_id","display_name","role","all_groups_access","group_ids"],"properties":{"id":{"type":"string","title":"The id schema","description":"The unique identifier of the user.","default":"","examples":["16ea2ecb-bc28-43e2-b66f-9edc48bef56f"]},"ars_permission":{"type":"boolean","title":"ARS permission","description":"ARS permission for the iuser","default":false,"examples":[false]},"account_id":{"type":"string","title":"The account_id","description":"Account id.","default":"","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"display_name":{"type":"string","title":"User display ame","description":"The display name of the user.","default":"","examples":["Alice Bob"]},"email":{"type":"string","title":"Email","description":"Email.","default":"","examples":["alicebob@malwarebytes.com"]},"last_login_at":{"type":"string","title":"The last time this user logged in","description":"Last login time","default":"","examples":["2018-10-05T15:15:36.116105Z"]},"unconfirmed_email":{"type":"string","title":"Unconfirmed email","description":"Unconfirmed email.","default":"","examples":[""]},"role":{"type":"string","title":"The Role of the user","description":"The role of the user.","enum":["SuperAdmin","Admin","ReadOnlyUser"],"examples":["SuperAdmin"]},"all_groups_access":{"type":"boolean","title":"Whether the user has access to all groups or not (applies to admin and readonly users)","default":false,"examples":[true]},"group_ids":{"type":"array","title":"The group_ids schema","default":[],"additionalItems":true,"items":{"type":"string","title":"Unique identifier of groups to which this user is assigned to"}},"otp_enabled":{"type":"boolean","title":"The otp_enabled schema","description":"Whether OTP is enabled or not.","default":false,"examples":[false]},"otp_recovery_email":{"type":"string","title":"The opt recovery email","description":"The opt recovery email","default":"","examples":["alicebob@malwarebytes.com"]},"otp_recovery_email_status":{"type":"string","title":"The opt recovery email status","description":"The opt recovery email status","default":"AwaitingSetup","examples":["AwaitingSetup","PendingVerification","ExpiredVerification","Verified"]}}}}}}},"tags":["V2 (RMM) Users"],"operationId":"api.rmm.put.users"}},"/api/v2/rmm/accounts/{account_id}/preferences/account_logo":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get account logo preferences response","required":["reports","emails"],"properties":{"emails":{"type":"boolean","title":"Include account logo in emails"},"reports":{"type":"boolean","title":"Include account logo in reports"}}}}}}},"tags":["V2 (RMM) Preferences"],"operationId":"api.rmm.get.preferences.account.logo"},"put":{"security":[{"oauth_ac":["write"]},{"client_credentials":["write"]},{"nebula":[]},{"user_permissions":["account.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get account logo preferences response","required":["reports","emails"],"properties":{"emails":{"type":"boolean","title":"Include account logo in emails"},"reports":{"type":"boolean","title":"Include account logo in reports"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get account logo preferences response","required":["reports","emails"],"properties":{"emails":{"type":"boolean","title":"Include account logo in emails"},"reports":{"type":"boolean","title":"Include account logo in reports"}}}}}}},"tags":["V2 (RMM) Preferences"],"operationId":"api.rmm.put.preferences.account.logo"}},"/api/v2/rmm/accounts/{account_id}/preferences/notifications":{"get":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["notifications.viewOthers"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema#","title":"Notifications options","type":"object","properties":{"webhook":{"title":"Webhook","type":"boolean","default":true},"email":{"title":"Email","type":"boolean","default":true},"slack":{"title":"Slack","type":"boolean","default":true},"teams":{"title":"Teams","type":"boolean","default":true},"mobile":{"title":"Mobile App (for Nebula only)","type":"boolean","default":true}}}}}}},"tags":["V2 (RMM) Preferences"],"operationId":"api.rmm.get.preferences.notifications"},"put":{"security":[{"oauth_ac":["read","write"]},{"client_credentials":["read","write"]},{"nebula":[]},{"user_permissions":["notifications.editOthers"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema#","title":"Notifications options","type":"object","properties":{"webhook":{"title":"Webhook","type":"boolean","default":true},"email":{"title":"Email","type":"boolean","default":true},"slack":{"title":"Slack","type":"boolean","default":true},"teams":{"title":"Teams","type":"boolean","default":true},"mobile":{"title":"Mobile App (for Nebula only)","type":"boolean","default":true}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema#","title":"Notifications options","type":"object","properties":{"webhook":{"title":"Webhook","type":"boolean","default":true},"email":{"title":"Email","type":"boolean","default":true},"slack":{"title":"Slack","type":"boolean","default":true},"teams":{"title":"Teams","type":"boolean","default":true},"mobile":{"title":"Mobile App (for Nebula only)","type":"boolean","default":true}}}}}}},"tags":["V2 (RMM) Preferences"],"operationId":"api.rmm.put.preferences.notifications"}},"/api/v2/rmm/remediation/remediate":{"delete":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["detections.performActions"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Mark remediation items as safe","required":["account_ids"],"allOf":[{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","description":"Mark remediations as safe accross endpoints","required":["items"],"examples":[{"items":{"6f47dfb6-02e1-4f60-863f-11bcf41a8456":["6f47bfb6-02e1-4f60-863f-11bcf41a8456"]}}],"properties":{"groups":{"type":"array","items":{"type":"object","title":"Search remediation","properties":{"fields":{"type":"array","title":"Specify which fields will be included in the response","items":{"enum":["id","account_id","machine_id","path","job_id","scanned_at","threat_name","status","category","type","options","machine_name","group_id","group_name","policy_id","policy_name","account_name","online"],"type":"string"},"default":["id","account_id","machine_id","path","job_id","scanned_at","threat_name","status","category","type","options"]},"sort_field":{"type":"string","title":"Sort field","enum":["scanned_at"],"default":"scanned_at"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"remediation constraints","items":{"title":"Remediation Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Remediation UID String Fields","enum":["id","machine_id","policy_id","group_id","job_id","account_id"]},{"title":"Remediation Simple String Fields","type":"string","enum":["account_name","group_name","machine_name","policy_name","threat_name","path","category","status","type"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Remediation UID String Fields","enum":["id","machine_id","policy_id","group_id","job_id","account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Remediation Simple String Fields","type":"string","enum":["account_name","group_name","machine_name","policy_name","threat_name","path","category","status","type"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Remediation Boolean Fields"}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Remediation Date Fields","enum":["scanned_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}}},"items":{"type":"object","patternProperties":{"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$":{"type":"array","minimum":0,"items":{"type":"string"}}}}},"additionalProperties":true},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema#","title":"Response schema for mark as safe","type":"object","properties":{"success":{"description":"Machine IDs affected","type":"array","items":{"type":"string"}},"errors":{"description":"Optional, sent only when an error occurs","type":"array","items":{"type":"string"}},"total_count":{"type":"number"}}}}}}},"tags":["V2 (RMM) Remediation"],"operationId":"api.rmm.delete.remediation.remediate"},"post":{"security":[{"oauth_ac":["execute"]},{"client_credentials":["execute"]},{"nebula":[]},{"user_permissions":["detections.performActions"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Issue remediation job","required":["account_ids"],"allOf":[{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","description":"Issue remediation jobs accross endpoints","required":["items"],"examples":[{"items":{"6f47dfb6-02e1-4f60-863f-11bcf41a8456":["6f47bfb6-02e1-4f60-863f-11bcf41a8456"]}}],"properties":{"groups":{"type":"array","items":{"type":"object","title":"Search remediation","properties":{"fields":{"type":"array","title":"Specify which fields will be included in the response","items":{"enum":["id","account_id","machine_id","path","job_id","scanned_at","threat_name","status","category","type","options","machine_name","group_id","group_name","policy_id","policy_name","account_name","online"],"type":"string"},"default":["id","account_id","machine_id","path","job_id","scanned_at","threat_name","status","category","type","options"]},"sort_field":{"type":"string","title":"Sort field","enum":["scanned_at"],"default":"scanned_at"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"remediation constraints","items":{"title":"Remediation Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Remediation UID String Fields","enum":["id","machine_id","policy_id","group_id","job_id","account_id"]},{"title":"Remediation Simple String Fields","type":"string","enum":["account_name","group_name","machine_name","policy_name","threat_name","path","category","status","type"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Remediation UID String Fields","enum":["id","machine_id","policy_id","group_id","job_id","account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Remediation Simple String Fields","type":"string","enum":["account_name","group_name","machine_name","policy_name","threat_name","path","category","status","type"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Remediation Boolean Fields"}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Remediation Date Fields","enum":["scanned_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}}},"items":{"type":"object","patternProperties":{"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$":{"type":"array","minimum":0,"items":{"type":"string"}}}}},"additionalProperties":true},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Create job response","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"List of jobs","items":{"type":"object","title":"Job items","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The ID of the endpoint onto which the job was issued (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The ID of the job. You can use this ID to retrieve additional informations about the job and track its progress, as well as use it as a reference to handle webhooks notifications (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}},"total_count":{"type":"integer","title":"The total number of issued jobs"},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["V2 (RMM) Remediation"],"operationId":"api.rmm.post.remediation.remediate"}},"/api/v2/rmm/remediation/export":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["select","format","groups"],"properties":{"groups":{"type":"array","items":{"type":"object","title":"Search remediation","allOf":[{"type":"object","title":"Search remediation","properties":{"fields":{"type":"array","title":"Specify which fields will be included in the response","items":{"enum":["id","account_id","machine_id","path","job_id","scanned_at","threat_name","status","category","type","options","machine_name","group_id","group_name","policy_id","policy_name","account_name","online"],"type":"string"},"default":["id","account_id","machine_id","path","job_id","scanned_at","threat_name","status","category","type","options"]},"sort_field":{"type":"string","title":"Sort field","enum":["scanned_at"],"default":"scanned_at"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"remediation constraints","items":{"title":"Remediation Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Remediation UID String Fields","enum":["id","machine_id","policy_id","group_id","job_id","account_id"]},{"title":"Remediation Simple String Fields","type":"string","enum":["account_name","group_name","machine_name","policy_name","threat_name","path","category","status","type"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Remediation UID String Fields","enum":["id","machine_id","policy_id","group_id","job_id","account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Remediation Simple String Fields","type":"string","enum":["account_name","group_name","machine_name","policy_name","threat_name","path","category","status","type"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Remediation Boolean Fields"}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Remediation Date Fields","enum":["scanned_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}},"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"filename":{"type":"string","title":"The name of the output file if download is set to true"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["id","account_id","machine_id","path","job_id","scanned_at","threat_name","status","category","type","options","machine_name","group_id","group_name","policy_id","policy_name","account_name"]}}}}}}}}},"responses":{},"tags":["V2 (RMM) Remediation"],"operationId":"api.rmm.export.remediation"}},"/api/v2/rmm/remediation/search":{"post":{"security":[{"oauth_ac":["read"]},{"client_credentials":["read"]},{"nebula":[]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search remediation","allOf":[{"type":"object","title":"Search remediation","properties":{"fields":{"type":"array","title":"Specify which fields will be included in the response","items":{"enum":["id","account_id","machine_id","path","job_id","scanned_at","threat_name","status","category","type","options","machine_name","group_id","group_name","policy_id","policy_name","account_name","online"],"type":"string"},"default":["id","account_id","machine_id","path","job_id","scanned_at","threat_name","status","category","type","options"]},"sort_field":{"type":"string","title":"Sort field","enum":["scanned_at"],"default":"scanned_at"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"remediation constraints","items":{"title":"Remediation Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Remediation UID String Fields","enum":["id","machine_id","policy_id","group_id","job_id","account_id"]},{"title":"Remediation Simple String Fields","type":"string","enum":["account_name","group_name","machine_name","policy_name","threat_name","path","category","status","type"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Remediation UID String Fields","enum":["id","machine_id","policy_id","group_id","job_id","account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Remediation Simple String Fields","type":"string","enum":["account_name","group_name","machine_name","policy_name","threat_name","path","category","status","type"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Remediation Boolean Fields"}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Remediation Date Fields","enum":["scanned_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Search remediations","description":"Search remediations","examples":[{"items":[{"id":"3b5e4696-408c-4d46-a94d-3fbe43d40596","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","machine_id":"9bf26c0e-5685-4a27-b096-42d51f1eb1b0","path":"C:\\Users\\Downloads\\administrator10\\sample_threat.exe","scanned_at":"2024-06-28T13:00:41.62367Z","threat_name":"Malware.AI.79000000000","status":"found","category":"Malware","type":["file"],"options":91,"policy_id":"6b46ad91-ca97-4732-8665-81ee1d01f677","policy_name":"Default Policy","account_name":"Test-Account3","group_id":"f4b15520-3153-4956-be41-185c4a523cfc","group_name":"Default Group","machine_name":"Alma's Work Laptop","online":true}],"total_count":1,"next_cursor":""}],"required":["items","total_count","next_cursor"],"properties":{"items":{"type":"array","title":"List of remediation items","description":"List of remediation items.","items":{"$schema":"http://json-schema.org/draft-07/schema#","title":"Remediation Item","type":"object","properties":{"id":{"type":"string"},"account_id":{"type":"string"},"machine_id":{"type":"string"},"path":{"type":"string"},"scanned_at":{"type":"string"},"threat_name":{"type":"string"},"status":{"type":"string"},"category":{"type":"string"},"type":{"type":"array","items":{"type":"string"}},"options":{"type":"number"},"policy_id":{"type":"string"},"policy_name":{"type":"string"},"account_name":{"type":"string"},"group_id":{"type":"string"},"group_name":{"type":"string"},"machine_name":{"type":"string"},"online":{"type":"boolean"}}}},"total_count":{"type":"integer","title":"Total count of items","description":"Total count of items","examples":[1]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["V2 (RMM) Remediation"],"operationId":"api.rmm.post.remediation-search"}},"/oauth2/token":{"post":{"status":{"outage":["oauth2"]},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"PostDetectionsSearchRes200","properties":{"access_token":{"type":"string","title":"Access token to be used to authenticate in API requests"},"expires_in":{"type":"number","title":"Time in seconds before the token expires"},"scope":{"type":"string","title":"The granted scope for this access token"},"token_type":{"type":"string","title":"The type of the token"},"refresh_token":{"type":"string","title":"With grant type authorization code refresh token gets also returned."},"id_token":{"type":"string","title":"With grant type authorization code id token gets also returned."}}}}}}},"tags":["oauth"],"operationId":"api.oauth2.token"}}},"components":{"securitySchemes":{"nebula":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"client_credentials":{"type":"oauth2","flows":{"clientCredentials":{"tokenUrl":"/token","scopes":{"read":"Read data of your Nebula account","write":"Write data, such as groups, policies, exclusions of your nebula data","execute":"Issue tasks on your endpoints","create:accounts":"Allow you to create nebula accounts you can manage through apis","admin":"Allow administrative actions for your applications. Do not require this scope unless you have a custom agreement with malwarebytes"}}}},"oauth_ac":{"type":"oauth2","authorizationUrl":"abnana","flows":{"authorizationCode":{"tokenUrl":"/token","authorizationUrl":"/auth/consent/initiate","scopes":{"read":"Read data of your Nebula account","write":"Write data, such as groups, policies, exclusions of your nebula data","execute":"Issue tasks on your endpoints","create:accounts":"Allow you to create nebula accounts you can manage through apis","admin":"Allow administrative actions for your applications","offline":"Allow offline access","openid":"Allow obtaining openid profile info"}}}},"user_permissions":{"type":"http","scheme":"bearer"}}}}