catocli 1.0.13__py3-none-any.whl → 1.0.15__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of catocli might be problematic. Click here for more details.

Files changed (253) hide show
  1. catocli/Utils/clidriver.py +15 -2
  2. catocli/__init__.py +1 -1
  3. catocli/parsers/custom/customLib.py +3 -1
  4. catocli/parsers/mutation_accountManagement/README.md +7 -0
  5. catocli/parsers/mutation_accountManagement/__init__.py +51 -0
  6. catocli/parsers/mutation_accountManagement_addAccount/README.md +17 -0
  7. catocli/parsers/mutation_accountManagement_removeAccount/README.md +16 -0
  8. catocli/parsers/mutation_accountManagement_updateAccount/README.md +17 -0
  9. catocli/parsers/mutation_admin_addAdmin/README.md +2 -2
  10. catocli/parsers/mutation_admin_updateAdmin/README.md +2 -2
  11. catocli/parsers/mutation_container_delete/README.md +2 -2
  12. catocli/parsers/mutation_policy_internetFirewall_addRule/README.md +3 -3
  13. catocli/parsers/mutation_policy_internetFirewall_addSection/README.md +3 -3
  14. catocli/parsers/mutation_policy_internetFirewall_createPolicyRevision/README.md +3 -3
  15. catocli/parsers/mutation_policy_internetFirewall_discardPolicyRevision/README.md +3 -3
  16. catocli/parsers/mutation_policy_internetFirewall_moveRule/README.md +3 -3
  17. catocli/parsers/mutation_policy_internetFirewall_moveSection/README.md +3 -3
  18. catocli/parsers/mutation_policy_internetFirewall_publishPolicyRevision/README.md +3 -3
  19. catocli/parsers/mutation_policy_internetFirewall_removeRule/README.md +3 -3
  20. catocli/parsers/mutation_policy_internetFirewall_removeSection/README.md +3 -3
  21. catocli/parsers/mutation_policy_internetFirewall_updatePolicy/README.md +3 -3
  22. catocli/parsers/mutation_policy_internetFirewall_updateRule/README.md +3 -3
  23. catocli/parsers/mutation_policy_internetFirewall_updateSection/README.md +3 -3
  24. catocli/parsers/mutation_policy_wanFirewall_addRule/README.md +3 -3
  25. catocli/parsers/mutation_policy_wanFirewall_addSection/README.md +3 -3
  26. catocli/parsers/mutation_policy_wanFirewall_createPolicyRevision/README.md +3 -3
  27. catocli/parsers/mutation_policy_wanFirewall_discardPolicyRevision/README.md +3 -3
  28. catocli/parsers/mutation_policy_wanFirewall_moveRule/README.md +3 -3
  29. catocli/parsers/mutation_policy_wanFirewall_moveSection/README.md +3 -3
  30. catocli/parsers/mutation_policy_wanFirewall_publishPolicyRevision/README.md +3 -3
  31. catocli/parsers/mutation_policy_wanFirewall_removeRule/README.md +3 -3
  32. catocli/parsers/mutation_policy_wanFirewall_removeSection/README.md +3 -3
  33. catocli/parsers/mutation_policy_wanFirewall_updatePolicy/README.md +3 -3
  34. catocli/parsers/mutation_policy_wanFirewall_updateRule/README.md +3 -3
  35. catocli/parsers/mutation_policy_wanFirewall_updateSection/README.md +3 -3
  36. catocli/parsers/mutation_site/__init__.py +14 -0
  37. catocli/parsers/mutation_site_addIpsecIkeV2Site/README.md +2 -2
  38. catocli/parsers/mutation_site_addIpsecIkeV2SiteTunnels/README.md +2 -2
  39. catocli/parsers/mutation_site_addNetworkRange/README.md +2 -2
  40. catocli/parsers/mutation_site_addSocketSite/README.md +2 -2
  41. catocli/parsers/mutation_site_addStaticHost/README.md +2 -2
  42. catocli/parsers/mutation_site_removeIpsecIkeV2SiteTunnels/README.md +18 -0
  43. catocli/parsers/mutation_site_updateHa/README.md +2 -2
  44. catocli/parsers/mutation_site_updateIpsecIkeV2SiteGeneralDetails/README.md +2 -2
  45. catocli/parsers/mutation_site_updateIpsecIkeV2SiteTunnels/README.md +2 -2
  46. catocli/parsers/mutation_site_updateNetworkRange/README.md +2 -2
  47. catocli/parsers/mutation_site_updateSiteGeneralDetails/README.md +2 -2
  48. catocli/parsers/mutation_site_updateSocketInterface/README.md +2 -2
  49. catocli/parsers/mutation_site_updateStaticHost/README.md +2 -2
  50. catocli/parsers/mutation_sites/__init__.py +14 -0
  51. catocli/parsers/mutation_sites_addIpsecIkeV2Site/README.md +2 -2
  52. catocli/parsers/mutation_sites_addIpsecIkeV2SiteTunnels/README.md +2 -2
  53. catocli/parsers/mutation_sites_addNetworkRange/README.md +2 -2
  54. catocli/parsers/mutation_sites_addSocketSite/README.md +2 -2
  55. catocli/parsers/mutation_sites_addStaticHost/README.md +2 -2
  56. catocli/parsers/mutation_sites_removeIpsecIkeV2SiteTunnels/README.md +18 -0
  57. catocli/parsers/mutation_sites_updateHa/README.md +2 -2
  58. catocli/parsers/mutation_sites_updateIpsecIkeV2SiteGeneralDetails/README.md +2 -2
  59. catocli/parsers/mutation_sites_updateIpsecIkeV2SiteTunnels/README.md +2 -2
  60. catocli/parsers/mutation_sites_updateNetworkRange/README.md +2 -2
  61. catocli/parsers/mutation_sites_updateSiteGeneralDetails/README.md +2 -2
  62. catocli/parsers/mutation_sites_updateSocketInterface/README.md +2 -2
  63. catocli/parsers/mutation_sites_updateStaticHost/README.md +2 -2
  64. catocli/parsers/parserApiClient.py +7 -4
  65. catocli/parsers/query_accountManagement/README.md +16 -0
  66. catocli/parsers/query_accountManagement/__init__.py +17 -0
  67. catocli/parsers/query_admins/README.md +2 -2
  68. catocli/parsers/query_appStats/README.md +5 -5
  69. catocli/parsers/query_appStatsTimeSeries/README.md +4 -4
  70. catocli/parsers/query_auditFeed/README.md +2 -2
  71. catocli/parsers/query_container/README.md +8 -8
  72. catocli/parsers/query_entityLookup/README.md +6 -6
  73. catocli/parsers/query_events/README.md +5 -5
  74. catocli/parsers/query_eventsFeed/README.md +2 -2
  75. catocli/parsers/query_eventsTimeSeries/README.md +4 -4
  76. catocli/parsers/query_hardwareManagement/README.md +2 -2
  77. catocli/parsers/query_policy/README.md +3 -3
  78. catocli/parsers/query_xdr_stories/README.md +2 -2
  79. {catocli-1.0.13.dist-info → catocli-1.0.15.dist-info}/METADATA +1 -1
  80. catocli-1.0.15.dist-info/RECORD +275 -0
  81. {catocli-1.0.13.dist-info → catocli-1.0.15.dist-info}/top_level.txt +0 -2
  82. graphql_client/api_client_types.py +4 -0
  83. models/mutation.accountManagement.addAccount.json +908 -0
  84. models/mutation.accountManagement.removeAccount.json +446 -0
  85. models/mutation.accountManagement.updateAccount.json +524 -0
  86. models/mutation.admin.addAdmin.json +103 -103
  87. models/mutation.admin.removeAdmin.json +3 -3
  88. models/mutation.admin.updateAdmin.json +121 -121
  89. models/mutation.container.delete.json +67 -67
  90. models/mutation.policy.internetFirewall.addRule.json +2497 -1889
  91. models/mutation.policy.internetFirewall.addSection.json +92 -92
  92. models/mutation.policy.internetFirewall.createPolicyRevision.json +734 -546
  93. models/mutation.policy.internetFirewall.discardPolicyRevision.json +734 -546
  94. models/mutation.policy.internetFirewall.moveRule.json +723 -535
  95. models/mutation.policy.internetFirewall.moveSection.json +85 -85
  96. models/mutation.policy.internetFirewall.publishPolicyRevision.json +734 -546
  97. models/mutation.policy.internetFirewall.removeRule.json +710 -522
  98. models/mutation.policy.internetFirewall.removeSection.json +72 -72
  99. models/mutation.policy.internetFirewall.updatePolicy.json +734 -546
  100. models/mutation.policy.internetFirewall.updateRule.json +2476 -1885
  101. models/mutation.policy.internetFirewall.updateSection.json +85 -85
  102. models/mutation.policy.wanFirewall.addRule.json +2577 -1225
  103. models/mutation.policy.wanFirewall.addSection.json +92 -92
  104. models/mutation.policy.wanFirewall.createPolicyRevision.json +800 -455
  105. models/mutation.policy.wanFirewall.discardPolicyRevision.json +800 -455
  106. models/mutation.policy.wanFirewall.moveRule.json +789 -444
  107. models/mutation.policy.wanFirewall.moveSection.json +85 -85
  108. models/mutation.policy.wanFirewall.publishPolicyRevision.json +800 -455
  109. models/mutation.policy.wanFirewall.removeRule.json +776 -431
  110. models/mutation.policy.wanFirewall.removeSection.json +72 -72
  111. models/mutation.policy.wanFirewall.updatePolicy.json +800 -455
  112. models/mutation.policy.wanFirewall.updateRule.json +2597 -1265
  113. models/mutation.policy.wanFirewall.updateSection.json +85 -85
  114. models/mutation.site.addIpsecIkeV2Site.json +43 -43
  115. models/mutation.site.addIpsecIkeV2SiteTunnels.json +505 -102
  116. models/mutation.site.addNetworkRange.json +53 -53
  117. models/mutation.site.addSocketSite.json +43 -43
  118. models/mutation.site.addStaticHost.json +33 -33
  119. models/mutation.site.removeIpsecIkeV2SiteTunnels.json +861 -0
  120. models/mutation.site.removeNetworkRange.json +3 -3
  121. models/mutation.site.removeSite.json +3 -3
  122. models/mutation.site.removeStaticHost.json +3 -3
  123. models/mutation.site.updateHa.json +54 -54
  124. models/mutation.site.updateIpsecIkeV2SiteGeneralDetails.json +79 -79
  125. models/mutation.site.updateIpsecIkeV2SiteTunnels.json +123 -123
  126. models/mutation.site.updateNetworkRange.json +74 -74
  127. models/mutation.site.updateSiteGeneralDetails.json +73 -73
  128. models/mutation.site.updateSocketInterface.json +282 -282
  129. models/mutation.site.updateStaticHost.json +54 -54
  130. models/mutation.sites.addIpsecIkeV2Site.json +43 -43
  131. models/mutation.sites.addIpsecIkeV2SiteTunnels.json +505 -102
  132. models/mutation.sites.addNetworkRange.json +53 -53
  133. models/mutation.sites.addSocketSite.json +43 -43
  134. models/mutation.sites.addStaticHost.json +33 -33
  135. models/mutation.sites.removeIpsecIkeV2SiteTunnels.json +861 -0
  136. models/mutation.sites.removeNetworkRange.json +3 -3
  137. models/mutation.sites.removeSite.json +3 -3
  138. models/mutation.sites.removeStaticHost.json +3 -3
  139. models/mutation.sites.updateHa.json +54 -54
  140. models/mutation.sites.updateIpsecIkeV2SiteGeneralDetails.json +79 -79
  141. models/mutation.sites.updateIpsecIkeV2SiteTunnels.json +123 -123
  142. models/mutation.sites.updateNetworkRange.json +74 -74
  143. models/mutation.sites.updateSiteGeneralDetails.json +73 -73
  144. models/mutation.sites.updateSocketInterface.json +282 -282
  145. models/mutation.sites.updateStaticHost.json +54 -54
  146. models/query.accountManagement.json +355 -0
  147. models/query.accountMetrics.json +235 -235
  148. models/query.accountRoles.json +3 -3
  149. models/query.accountSnapshot.json +278 -118
  150. models/query.admin.json +24 -24
  151. models/query.admins.json +138 -138
  152. models/query.appStats.json +92 -92
  153. models/query.appStatsTimeSeries.json +78 -78
  154. models/query.auditFeed.json +77 -77
  155. models/query.container.json +192 -192
  156. models/query.entityLookup.json +154 -154
  157. models/query.events.json +54 -54
  158. models/query.eventsFeed.json +38 -38
  159. models/query.eventsTimeSeries.json +78 -78
  160. models/query.hardwareManagement.json +125 -125
  161. models/query.licensing.json +933 -249
  162. models/query.policy.json +1502 -970
  163. models/query.xdr.stories.json +842 -842
  164. models/query.xdr.story.json +610 -610
  165. schema/catolib.py +12 -13
  166. build/lib/catocli/Utils/clidriver.py +0 -117
  167. build/lib/catocli/__init__.py +0 -2
  168. build/lib/catocli/__main__.py +0 -12
  169. build/lib/catocli/parsers/custom/__init__.py +0 -47
  170. build/lib/catocli/parsers/custom/customLib.py +0 -70
  171. build/lib/catocli/parsers/mutation_admin/__init__.py +0 -51
  172. build/lib/catocli/parsers/mutation_container/__init__.py +0 -23
  173. build/lib/catocli/parsers/mutation_policy/__init__.py +0 -357
  174. build/lib/catocli/parsers/mutation_site/__init__.py +0 -219
  175. build/lib/catocli/parsers/mutation_sites/__init__.py +0 -219
  176. build/lib/catocli/parsers/parserApiClient.py +0 -309
  177. build/lib/catocli/parsers/query_accountBySubdomain/__init__.py +0 -17
  178. build/lib/catocli/parsers/query_accountMetrics/__init__.py +0 -17
  179. build/lib/catocli/parsers/query_accountRoles/__init__.py +0 -17
  180. build/lib/catocli/parsers/query_accountSnapshot/__init__.py +0 -17
  181. build/lib/catocli/parsers/query_admin/__init__.py +0 -17
  182. build/lib/catocli/parsers/query_admins/__init__.py +0 -17
  183. build/lib/catocli/parsers/query_appStats/__init__.py +0 -17
  184. build/lib/catocli/parsers/query_appStatsTimeSeries/__init__.py +0 -17
  185. build/lib/catocli/parsers/query_auditFeed/__init__.py +0 -17
  186. build/lib/catocli/parsers/query_container/__init__.py +0 -17
  187. build/lib/catocli/parsers/query_entityLookup/__init__.py +0 -17
  188. build/lib/catocli/parsers/query_events/__init__.py +0 -17
  189. build/lib/catocli/parsers/query_eventsFeed/__init__.py +0 -17
  190. build/lib/catocli/parsers/query_eventsTimeSeries/__init__.py +0 -17
  191. build/lib/catocli/parsers/query_hardwareManagement/__init__.py +0 -17
  192. build/lib/catocli/parsers/query_licensing/__init__.py +0 -17
  193. build/lib/catocli/parsers/query_policy/__init__.py +0 -17
  194. build/lib/catocli/parsers/query_siteLocation/__init__.py +0 -17
  195. build/lib/catocli/parsers/query_subDomains/__init__.py +0 -17
  196. build/lib/catocli/parsers/query_xdr/__init__.py +0 -37
  197. build/lib/catocli/parsers/raw/__init__.py +0 -9
  198. build/lib/graphql_client/__init__.py +0 -11
  199. build/lib/graphql_client/api/__init__.py +0 -3
  200. build/lib/graphql_client/api/call_api.py +0 -73
  201. build/lib/graphql_client/api_client.py +0 -192
  202. build/lib/graphql_client/api_client_types.py +0 -404
  203. build/lib/graphql_client/configuration.py +0 -230
  204. build/lib/graphql_client/models/__init__.py +0 -13
  205. build/lib/graphql_client/models/no_schema.py +0 -71
  206. build/lib/schema/catolib.py +0 -1016
  207. build/lib/schema/importSchema.py +0 -60
  208. build/lib/vendor/certifi/__init__.py +0 -4
  209. build/lib/vendor/certifi/__main__.py +0 -12
  210. build/lib/vendor/certifi/core.py +0 -114
  211. build/lib/vendor/certifi/py.typed +0 -0
  212. build/lib/vendor/six.py +0 -998
  213. build/lib/vendor/urllib3/__init__.py +0 -211
  214. build/lib/vendor/urllib3/_base_connection.py +0 -172
  215. build/lib/vendor/urllib3/_collections.py +0 -483
  216. build/lib/vendor/urllib3/_request_methods.py +0 -278
  217. build/lib/vendor/urllib3/_version.py +0 -16
  218. build/lib/vendor/urllib3/connection.py +0 -1033
  219. build/lib/vendor/urllib3/connectionpool.py +0 -1182
  220. build/lib/vendor/urllib3/contrib/__init__.py +0 -0
  221. build/lib/vendor/urllib3/contrib/emscripten/__init__.py +0 -18
  222. build/lib/vendor/urllib3/contrib/emscripten/connection.py +0 -254
  223. build/lib/vendor/urllib3/contrib/emscripten/fetch.py +0 -418
  224. build/lib/vendor/urllib3/contrib/emscripten/request.py +0 -22
  225. build/lib/vendor/urllib3/contrib/emscripten/response.py +0 -285
  226. build/lib/vendor/urllib3/contrib/pyopenssl.py +0 -552
  227. build/lib/vendor/urllib3/contrib/socks.py +0 -228
  228. build/lib/vendor/urllib3/exceptions.py +0 -321
  229. build/lib/vendor/urllib3/fields.py +0 -341
  230. build/lib/vendor/urllib3/filepost.py +0 -89
  231. build/lib/vendor/urllib3/http2/__init__.py +0 -53
  232. build/lib/vendor/urllib3/http2/connection.py +0 -356
  233. build/lib/vendor/urllib3/http2/probe.py +0 -87
  234. build/lib/vendor/urllib3/poolmanager.py +0 -637
  235. build/lib/vendor/urllib3/py.typed +0 -2
  236. build/lib/vendor/urllib3/response.py +0 -1265
  237. build/lib/vendor/urllib3/util/__init__.py +0 -42
  238. build/lib/vendor/urllib3/util/connection.py +0 -137
  239. build/lib/vendor/urllib3/util/proxy.py +0 -43
  240. build/lib/vendor/urllib3/util/request.py +0 -256
  241. build/lib/vendor/urllib3/util/response.py +0 -101
  242. build/lib/vendor/urllib3/util/retry.py +0 -533
  243. build/lib/vendor/urllib3/util/ssl_.py +0 -513
  244. build/lib/vendor/urllib3/util/ssl_match_hostname.py +0 -159
  245. build/lib/vendor/urllib3/util/ssltransport.py +0 -276
  246. build/lib/vendor/urllib3/util/timeout.py +0 -275
  247. build/lib/vendor/urllib3/util/url.py +0 -471
  248. build/lib/vendor/urllib3/util/util.py +0 -42
  249. build/lib/vendor/urllib3/util/wait.py +0 -124
  250. catocli-1.0.13.dist-info/RECORD +0 -344
  251. {catocli-1.0.13.dist-info → catocli-1.0.15.dist-info}/LICENSE +0 -0
  252. {catocli-1.0.13.dist-info → catocli-1.0.15.dist-info}/WHEEL +0 -0
  253. {catocli-1.0.13.dist-info → catocli-1.0.15.dist-info}/entry_points.txt +0 -0
models/query.xdr.story.json CHANGED
@@ -531,9 +531,9 @@
531
531
  "isDeprecated": false,
532
532
  "name": "story",
533
533
  "path": "story",
534
- "requestStr": "$Story:Story ",
534
+ "requestStr": "$story:Story ",
535
535
  "required": false,
536
- "responseStr": "story:$Story ",
536
+ "responseStr": "story:$story ",
537
537
  "type": {
538
538
  "definition": {
539
539
  "description": null,
@@ -670,16 +670,16 @@
670
670
  "isDeprecated": false,
671
671
  "name": "incident",
672
672
  "path": "story.incident",
673
- "requestStr": "$MergedIncident:MergedIncident! ",
673
+ "requestStr": "$mergedIncident:MergedIncident! ",
674
674
  "required": true,
675
- "responseStr": "incident:$MergedIncident ",
675
+ "responseStr": "incident:$mergedIncident ",
676
676
  "type": {
677
677
  "definition": {
678
678
  "description": null,
679
679
  "enumValues": null,
680
680
  "fields": {
681
681
  "analystFeedback": {
682
- "alias": "AnalystFeedbackAnalystFeedback: analystFeedback",
682
+ "alias": "analystFeedbackAnalystFeedback: analystFeedback",
683
683
  "args": {},
684
684
  "deprecationReason": null,
685
685
  "description": "Fields related to analysts research of the threat incident",
@@ -687,9 +687,9 @@
687
687
  "isDeprecated": false,
688
688
  "name": "analystFeedback",
689
689
  "path": "story.incident.analystFeedback",
690
- "requestStr": "$AnalystFeedback:AnalystFeedback ",
690
+ "requestStr": "$analystFeedback:AnalystFeedback ",
691
691
  "required": false,
692
- "responseStr": "analystFeedback:$AnalystFeedback ",
692
+ "responseStr": "analystFeedback:$analystFeedback ",
693
693
  "type": {
694
694
  "definition": {
695
695
  "description": null,
@@ -793,9 +793,9 @@
793
793
  "isDeprecated": false,
794
794
  "name": "threatType",
795
795
  "path": "story.incident.analystFeedback.threatType",
796
- "requestStr": "$AnalystFeedbackThreatType:AnalystFeedbackThreatType ",
796
+ "requestStr": "$analystFeedbackThreatType:AnalystFeedbackThreatType ",
797
797
  "required": false,
798
- "responseStr": "threatType:$AnalystFeedbackThreatType ",
798
+ "responseStr": "threatType:$analystFeedbackThreatType ",
799
799
  "type": {
800
800
  "definition": {
801
801
  "description": null,
@@ -875,7 +875,7 @@
875
875
  "name": "AnalystFeedbackThreatType",
876
876
  "non_null": false
877
877
  },
878
- "varName": "AnalystFeedbackThreatType"
878
+ "varName": "analystFeedbackThreatType"
879
879
  },
880
880
  "verdict": {
881
881
  "args": {},
@@ -947,10 +947,10 @@
947
947
  "name": "AnalystFeedback",
948
948
  "non_null": false
949
949
  },
950
- "varName": "AnalystFeedback"
950
+ "varName": "analystFeedback"
951
951
  },
952
952
  "connectionType": {
953
- "alias": "ConnectionTypeEnumConnectionType: connectionType",
953
+ "alias": "connectionTypeEnumConnectionType: connectionType",
954
954
  "args": {},
955
955
  "deprecationReason": null,
956
956
  "description": "Enum for the connection for this incident (ie. site, host, user)",
@@ -1041,7 +1041,7 @@
1041
1041
  "varName": "description"
1042
1042
  },
1043
1043
  "engineType": {
1044
- "alias": "StoryEngineTypeEnumEngineType: engineType",
1044
+ "alias": "storyEngineTypeEnumEngineType: engineType",
1045
1045
  "args": {},
1046
1046
  "deprecationReason": null,
1047
1047
  "description": "XDR engine involved with the incident",
@@ -1208,7 +1208,7 @@
1208
1208
  "varName": "predictedThreatType"
1209
1209
  },
1210
1210
  "predictedVerdict": {
1211
- "alias": "StoryVerdictEnumPredictedVerdict: predictedVerdict",
1211
+ "alias": "storyVerdictEnumPredictedVerdict: predictedVerdict",
1212
1212
  "args": {},
1213
1213
  "deprecationReason": null,
1214
1214
  "description": null,
@@ -1265,7 +1265,7 @@
1265
1265
  "varName": "predictedVerdict"
1266
1266
  },
1267
1267
  "producer": {
1268
- "alias": "StoryProducerEnumProducer: producer",
1268
+ "alias": "storyProducerEnumProducer: producer",
1269
1269
  "args": {},
1270
1270
  "deprecationReason": null,
1271
1271
  "description": "Enum for the Producer (specific XDR engine and service) involved with the incident",
@@ -1414,7 +1414,7 @@
1414
1414
  "varName": "research"
1415
1415
  },
1416
1416
  "site": {
1417
- "alias": "SiteRefSite: site",
1417
+ "alias": "siteRefSite: site",
1418
1418
  "args": {},
1419
1419
  "deprecationReason": null,
1420
1420
  "description": "Cato ID and name for the site",
@@ -1422,9 +1422,9 @@
1422
1422
  "isDeprecated": false,
1423
1423
  "name": "site",
1424
1424
  "path": "story.incident.site",
1425
- "requestStr": "$SiteRef:SiteRef ",
1425
+ "requestStr": "$siteRef:SiteRef ",
1426
1426
  "required": false,
1427
- "responseStr": "site:$SiteRef ",
1427
+ "responseStr": "site:$siteRef ",
1428
1428
  "type": {
1429
1429
  "definition": {
1430
1430
  "description": null,
@@ -1486,7 +1486,7 @@
1486
1486
  "name": "SiteRef",
1487
1487
  "non_null": false
1488
1488
  },
1489
- "varName": "SiteRef"
1489
+ "varName": "siteRef"
1490
1490
  },
1491
1491
  "siteName": {
1492
1492
  "args": {},
@@ -1549,7 +1549,7 @@
1549
1549
  "varName": "sourceIp"
1550
1550
  },
1551
1551
  "status": {
1552
- "alias": "StoryStatusEnumStatus: status",
1552
+ "alias": "storyStatusEnumStatus: status",
1553
1553
  "args": {},
1554
1554
  "deprecationReason": null,
1555
1555
  "description": "Enum for the status of this story (ie. Open, Closed, Monitoring)",
@@ -1658,7 +1658,7 @@
1658
1658
  "varName": "ticket"
1659
1659
  },
1660
1660
  "user": {
1661
- "alias": "UserRefUser: user",
1661
+ "alias": "userRefUser: user",
1662
1662
  "args": {},
1663
1663
  "deprecationReason": null,
1664
1664
  "description": "Cato ID and name for the user",
@@ -1666,9 +1666,9 @@
1666
1666
  "isDeprecated": false,
1667
1667
  "name": "user",
1668
1668
  "path": "story.incident.user",
1669
- "requestStr": "$UserRef:UserRef ",
1669
+ "requestStr": "$userRef:UserRef ",
1670
1670
  "required": false,
1671
- "responseStr": "user:$UserRef ",
1671
+ "responseStr": "user:$userRef ",
1672
1672
  "type": {
1673
1673
  "definition": {
1674
1674
  "description": null,
@@ -1730,10 +1730,10 @@
1730
1730
  "name": "UserRef",
1731
1731
  "non_null": false
1732
1732
  },
1733
- "varName": "UserRef"
1733
+ "varName": "userRef"
1734
1734
  },
1735
1735
  "vendor": {
1736
- "alias": "VendorEnumVendor: vendor",
1736
+ "alias": "vendorEnumVendor: vendor",
1737
1737
  "args": {},
1738
1738
  "deprecationReason": null,
1739
1739
  "description": "Vendor that identified the incident, such as Cato or Microsoft",
@@ -1788,7 +1788,7 @@
1788
1788
  "enumValues": null,
1789
1789
  "fields": {
1790
1790
  "analystFeedback": {
1791
- "alias": "AnalystFeedback: analystFeedback",
1791
+ "alias": "analystFeedback: analystFeedback",
1792
1792
  "args": {},
1793
1793
  "deprecationReason": null,
1794
1794
  "description": null,
@@ -1796,9 +1796,9 @@
1796
1796
  "isDeprecated": false,
1797
1797
  "name": "analystFeedback",
1798
1798
  "path": "story.incident.AnomalyEvents.analystFeedback",
1799
- "requestStr": "$AnalystFeedback:AnalystFeedback ",
1799
+ "requestStr": "$analystFeedback:AnalystFeedback ",
1800
1800
  "required": false,
1801
- "responseStr": "analystFeedback:$AnalystFeedback ",
1801
+ "responseStr": "analystFeedback:$analystFeedback ",
1802
1802
  "type": {
1803
1803
  "definition": {
1804
1804
  "description": null,
@@ -1902,9 +1902,9 @@
1902
1902
  "isDeprecated": false,
1903
1903
  "name": "threatType",
1904
1904
  "path": "story.incident.AnomalyEvents.analystFeedback.threatType",
1905
- "requestStr": "$AnalystFeedbackThreatType:AnalystFeedbackThreatType ",
1905
+ "requestStr": "$analystFeedbackThreatType:AnalystFeedbackThreatType ",
1906
1906
  "required": false,
1907
- "responseStr": "threatType:$AnalystFeedbackThreatType ",
1907
+ "responseStr": "threatType:$analystFeedbackThreatType ",
1908
1908
  "type": {
1909
1909
  "definition": {
1910
1910
  "description": null,
@@ -1984,7 +1984,7 @@
1984
1984
  "name": "AnalystFeedbackThreatType",
1985
1985
  "non_null": false
1986
1986
  },
1987
- "varName": "AnalystFeedbackThreatType"
1987
+ "varName": "analystFeedbackThreatType"
1988
1988
  },
1989
1989
  "verdict": {
1990
1990
  "args": {},
@@ -2056,7 +2056,7 @@
2056
2056
  "name": "AnalystFeedback",
2057
2057
  "non_null": false
2058
2058
  },
2059
- "varName": "AnalystFeedback"
2059
+ "varName": "analystFeedback"
2060
2060
  },
2061
2061
  "breakdownField": {
2062
2062
  "args": {},
@@ -2102,7 +2102,7 @@
2102
2102
  "varName": "clientClass"
2103
2103
  },
2104
2104
  "connectionType": {
2105
- "alias": "AnomalyEventsConnectionType: connectionType",
2105
+ "alias": "anomalyEventsConnectionType: connectionType",
2106
2106
  "args": {},
2107
2107
  "deprecationReason": null,
2108
2108
  "description": null,
@@ -2153,7 +2153,7 @@
2153
2153
  "varName": "connectionType"
2154
2154
  },
2155
2155
  "criticality": {
2156
- "alias": "AnomalyEventsCriticality: criticality",
2156
+ "alias": "anomalyEventsCriticality: criticality",
2157
2157
  "args": {},
2158
2158
  "deprecationReason": null,
2159
2159
  "description": null,
@@ -2174,7 +2174,7 @@
2174
2174
  "varName": "criticality"
2175
2175
  },
2176
2176
  "description": {
2177
- "alias": "AnomalyEventsDescription: description",
2177
+ "alias": "anomalyEventsDescription: description",
2178
2178
  "args": {},
2179
2179
  "deprecationReason": null,
2180
2180
  "description": null,
@@ -2242,9 +2242,9 @@
2242
2242
  "isDeprecated": false,
2243
2243
  "name": "drillDownFilter",
2244
2244
  "path": "story.incident.AnomalyEvents.drillDownFilter",
2245
- "requestStr": "$StoryDrillDownFilter:[StoryDrillDownFilter] ",
2245
+ "requestStr": "$storyDrillDownFilter:[StoryDrillDownFilter] ",
2246
2246
  "required": false,
2247
- "responseStr": "drillDownFilter:$StoryDrillDownFilter ",
2247
+ "responseStr": "drillDownFilter:$storyDrillDownFilter ",
2248
2248
  "type": {
2249
2249
  "definition": {
2250
2250
  "description": null,
@@ -2308,10 +2308,10 @@
2308
2308
  "name": "StoryDrillDownFilter",
2309
2309
  "non_null": false
2310
2310
  },
2311
- "varName": "StoryDrillDownFilter"
2311
+ "varName": "storyDrillDownFilter"
2312
2312
  },
2313
2313
  "engineType": {
2314
- "alias": "AnomalyEventsEngineType: engineType",
2314
+ "alias": "anomalyEventsEngineType: engineType",
2315
2315
  "args": {},
2316
2316
  "deprecationReason": null,
2317
2317
  "description": null,
@@ -2381,9 +2381,9 @@
2381
2381
  "isDeprecated": false,
2382
2382
  "name": "extra",
2383
2383
  "path": "story.incident.AnomalyEvents.extra",
2384
- "requestStr": "$Extra:[Extra] ",
2384
+ "requestStr": "$extra:[Extra] ",
2385
2385
  "required": false,
2386
- "responseStr": "extra:$Extra ",
2386
+ "responseStr": "extra:$extra ",
2387
2387
  "type": {
2388
2388
  "definition": {
2389
2389
  "description": null,
@@ -2468,10 +2468,10 @@
2468
2468
  "name": "Extra",
2469
2469
  "non_null": false
2470
2470
  },
2471
- "varName": "Extra"
2471
+ "varName": "extra"
2472
2472
  },
2473
2473
  "firstSignal": {
2474
- "alias": "AnomalyEventsFirstSignal: firstSignal",
2474
+ "alias": "anomalyEventsFirstSignal: firstSignal",
2475
2475
  "args": {},
2476
2476
  "deprecationReason": null,
2477
2477
  "description": null,
@@ -2500,9 +2500,9 @@
2500
2500
  "isDeprecated": false,
2501
2501
  "name": "gaussian",
2502
2502
  "path": "story.incident.AnomalyEvents.gaussian",
2503
- "requestStr": "$Gaussian:Gaussian ",
2503
+ "requestStr": "$gaussian:Gaussian ",
2504
2504
  "required": false,
2505
- "responseStr": "gaussian:$Gaussian ",
2505
+ "responseStr": "gaussian:$gaussian ",
2506
2506
  "type": {
2507
2507
  "definition": {
2508
2508
  "description": null,
@@ -2622,10 +2622,10 @@
2622
2622
  "name": "Gaussian",
2623
2623
  "non_null": false
2624
2624
  },
2625
- "varName": "Gaussian"
2625
+ "varName": "gaussian"
2626
2626
  },
2627
2627
  "id": {
2628
- "alias": "AnomalyEventsId: id",
2628
+ "alias": "anomalyEventsId: id",
2629
2629
  "args": {},
2630
2630
  "deprecationReason": null,
2631
2631
  "description": null,
@@ -2647,7 +2647,7 @@
2647
2647
  "varName": "id"
2648
2648
  },
2649
2649
  "indication": {
2650
- "alias": "AnomalyEventsIndication: indication",
2650
+ "alias": "anomalyEventsIndication: indication",
2651
2651
  "args": {},
2652
2652
  "deprecationReason": null,
2653
2653
  "description": null,
@@ -2669,7 +2669,7 @@
2669
2669
  "varName": "indication"
2670
2670
  },
2671
2671
  "lastSignal": {
2672
- "alias": "AnomalyEventsLastSignal: lastSignal",
2672
+ "alias": "anomalyEventsLastSignal: lastSignal",
2673
2673
  "args": {},
2674
2674
  "deprecationReason": null,
2675
2675
  "description": null,
@@ -2738,9 +2738,9 @@
2738
2738
  "isDeprecated": false,
2739
2739
  "name": "metric",
2740
2740
  "path": "story.incident.AnomalyEvents.metric",
2741
- "requestStr": "$Metric:Metric ",
2741
+ "requestStr": "$metric:Metric ",
2742
2742
  "required": false,
2743
- "responseStr": "metric:$Metric ",
2743
+ "responseStr": "metric:$metric ",
2744
2744
  "type": {
2745
2745
  "definition": {
2746
2746
  "description": null,
@@ -2802,7 +2802,7 @@
2802
2802
  "name": "Metric",
2803
2803
  "non_null": false
2804
2804
  },
2805
- "varName": "Metric"
2805
+ "varName": "metric"
2806
2806
  },
2807
2807
  "metricDetails": {
2808
2808
  "args": {},
@@ -2812,9 +2812,9 @@
2812
2812
  "isDeprecated": false,
2813
2813
  "name": "metricDetails",
2814
2814
  "path": "story.incident.AnomalyEvents.metricDetails",
2815
- "requestStr": "$MetricDetails:MetricDetails ",
2815
+ "requestStr": "$metricDetails:MetricDetails ",
2816
2816
  "required": false,
2817
- "responseStr": "metricDetails:$MetricDetails ",
2817
+ "responseStr": "metricDetails:$metricDetails ",
2818
2818
  "type": {
2819
2819
  "definition": {
2820
2820
  "description": null,
@@ -2876,7 +2876,7 @@
2876
2876
  "name": "MetricDetails",
2877
2877
  "non_null": false
2878
2878
  },
2879
- "varName": "MetricDetails"
2879
+ "varName": "metricDetails"
2880
2880
  },
2881
2881
  "mitres": {
2882
2882
  "args": {},
@@ -2886,9 +2886,9 @@
2886
2886
  "isDeprecated": false,
2887
2887
  "name": "mitres",
2888
2888
  "path": "story.incident.AnomalyEvents.mitres",
2889
- "requestStr": "$Mitre:[Mitre] ",
2889
+ "requestStr": "$mitre:[Mitre] ",
2890
2890
  "required": false,
2891
- "responseStr": "mitres:$Mitre ",
2891
+ "responseStr": "mitres:$mitre ",
2892
2892
  "type": {
2893
2893
  "definition": {
2894
2894
  "description": null,
@@ -2950,7 +2950,7 @@
2950
2950
  "name": "Mitre",
2951
2951
  "non_null": false
2952
2952
  },
2953
- "varName": "Mitre"
2953
+ "varName": "mitre"
2954
2954
  },
2955
2955
  "os": {
2956
2956
  "args": {},
@@ -2973,7 +2973,7 @@
2973
2973
  "varName": "os"
2974
2974
  },
2975
2975
  "predictedThreatType": {
2976
- "alias": "AnomalyEventsPredictedThreatType: predictedThreatType",
2976
+ "alias": "anomalyEventsPredictedThreatType: predictedThreatType",
2977
2977
  "args": {},
2978
2978
  "deprecationReason": null,
2979
2979
  "description": null,
@@ -2994,7 +2994,7 @@
2994
2994
  "varName": "predictedThreatType"
2995
2995
  },
2996
2996
  "predictedVerdict": {
2997
- "alias": "AnomalyEventsPredictedVerdict: predictedVerdict",
2997
+ "alias": "anomalyEventsPredictedVerdict: predictedVerdict",
2998
2998
  "args": {},
2999
2999
  "deprecationReason": null,
3000
3000
  "description": null,
@@ -3051,7 +3051,7 @@
3051
3051
  "varName": "predictedVerdict"
3052
3052
  },
3053
3053
  "producer": {
3054
- "alias": "AnomalyEventsProducer: producer",
3054
+ "alias": "anomalyEventsProducer: producer",
3055
3055
  "args": {},
3056
3056
  "deprecationReason": null,
3057
3057
  "description": null,
@@ -3139,7 +3139,7 @@
3139
3139
  "varName": "producer"
3140
3140
  },
3141
3141
  "producerName": {
3142
- "alias": "AnomalyEventsProducerName: producerName",
3142
+ "alias": "anomalyEventsProducerName: producerName",
3143
3143
  "args": {},
3144
3144
  "deprecationReason": null,
3145
3145
  "description": null,
@@ -3161,7 +3161,7 @@
3161
3161
  "varName": "producerName"
3162
3162
  },
3163
3163
  "queryName": {
3164
- "alias": "AnomalyEventsQueryName: queryName",
3164
+ "alias": "anomalyEventsQueryName: queryName",
3165
3165
  "args": {},
3166
3166
  "deprecationReason": null,
3167
3167
  "description": null,
@@ -3182,7 +3182,7 @@
3182
3182
  "varName": "queryName"
3183
3183
  },
3184
3184
  "research": {
3185
- "alias": "AnomalyEventsResearch: research",
3185
+ "alias": "anomalyEventsResearch: research",
3186
3186
  "args": {},
3187
3187
  "deprecationReason": null,
3188
3188
  "description": null,
@@ -3232,9 +3232,9 @@
3232
3232
  "isDeprecated": false,
3233
3233
  "name": "similarStoriesData",
3234
3234
  "path": "story.incident.AnomalyEvents.similarStoriesData",
3235
- "requestStr": "$SimilarStoryData:[SimilarStoryData]! ",
3235
+ "requestStr": "$similarStoryData:[SimilarStoryData]! ",
3236
3236
  "required": true,
3237
- "responseStr": "similarStoriesData:$SimilarStoryData ",
3237
+ "responseStr": "similarStoriesData:$similarStoryData ",
3238
3238
  "type": {
3239
3239
  "definition": {
3240
3240
  "description": null,
@@ -3377,10 +3377,10 @@
3377
3377
  "name": "SimilarStoryData",
3378
3378
  "non_null": false
3379
3379
  },
3380
- "varName": "SimilarStoryData"
3380
+ "varName": "similarStoryData"
3381
3381
  },
3382
3382
  "site": {
3383
- "alias": "SiteRef: site",
3383
+ "alias": "siteRef: site",
3384
3384
  "args": {},
3385
3385
  "deprecationReason": null,
3386
3386
  "description": null,
@@ -3388,9 +3388,9 @@
3388
3388
  "isDeprecated": false,
3389
3389
  "name": "site",
3390
3390
  "path": "story.incident.AnomalyEvents.site",
3391
- "requestStr": "$SiteRef:SiteRef ",
3391
+ "requestStr": "$siteRef:SiteRef ",
3392
3392
  "required": false,
3393
- "responseStr": "site:$SiteRef ",
3393
+ "responseStr": "site:$siteRef ",
3394
3394
  "type": {
3395
3395
  "definition": {
3396
3396
  "description": null,
@@ -3452,10 +3452,10 @@
3452
3452
  "name": "SiteRef",
3453
3453
  "non_null": false
3454
3454
  },
3455
- "varName": "SiteRef"
3455
+ "varName": "siteRef"
3456
3456
  },
3457
3457
  "siteName": {
3458
- "alias": "AnomalyEventsSiteName: siteName",
3458
+ "alias": "anomalyEventsSiteName: siteName",
3459
3459
  "args": {},
3460
3460
  "deprecationReason": null,
3461
3461
  "description": null,
@@ -3476,7 +3476,7 @@
3476
3476
  "varName": "siteName"
3477
3477
  },
3478
3478
  "source": {
3479
- "alias": "AnomalyEventsSource: source",
3479
+ "alias": "anomalyEventsSource: source",
3480
3480
  "args": {},
3481
3481
  "deprecationReason": null,
3482
3482
  "description": null,
@@ -3497,7 +3497,7 @@
3497
3497
  "varName": "source"
3498
3498
  },
3499
3499
  "sourceIp": {
3500
- "alias": "AnomalyEventsSourceIp: sourceIp",
3500
+ "alias": "anomalyEventsSourceIp: sourceIp",
3501
3501
  "args": {},
3502
3502
  "deprecationReason": null,
3503
3503
  "description": null,
@@ -3538,7 +3538,7 @@
3538
3538
  "varName": "srcSiteId"
3539
3539
  },
3540
3540
  "status": {
3541
- "alias": "AnomalyEventsStatus: status",
3541
+ "alias": "anomalyEventsStatus: status",
3542
3542
  "args": {},
3543
3543
  "deprecationReason": null,
3544
3544
  "description": null,
@@ -3607,7 +3607,7 @@
3607
3607
  "varName": "status"
3608
3608
  },
3609
3609
  "storyDuration": {
3610
- "alias": "AnomalyEventsStoryDuration: storyDuration",
3610
+ "alias": "anomalyEventsStoryDuration: storyDuration",
3611
3611
  "args": {},
3612
3612
  "deprecationReason": null,
3613
3613
  "description": null,
@@ -3655,9 +3655,9 @@
3655
3655
  "isDeprecated": false,
3656
3656
  "name": "targets",
3657
3657
  "path": "story.incident.AnomalyEvents.targets",
3658
- "requestStr": "$IncidentTargetRep:[IncidentTargetRep]! ",
3658
+ "requestStr": "$incidentTargetRep:[IncidentTargetRep]! ",
3659
3659
  "required": true,
3660
- "responseStr": "targets:$IncidentTargetRep ",
3660
+ "responseStr": "targets:$incidentTargetRep ",
3661
3661
  "type": {
3662
3662
  "definition": {
3663
3663
  "description": null,
@@ -3784,7 +3784,7 @@
3784
3784
  "varName": "engines"
3785
3785
  },
3786
3786
  "eventData": {
3787
- "alias": "EventEventData: eventData",
3787
+ "alias": "eventEventData: eventData",
3788
3788
  "args": {},
3789
3789
  "deprecationReason": null,
3790
3790
  "description": null,
@@ -3792,9 +3792,9 @@
3792
3792
  "isDeprecated": false,
3793
3793
  "name": "eventData",
3794
3794
  "path": "story.incident.AnomalyEvents.targets.eventData",
3795
- "requestStr": "$Event:[Event]! ",
3795
+ "requestStr": "$event:[Event]! ",
3796
3796
  "required": true,
3797
- "responseStr": "eventData:$Event ",
3797
+ "responseStr": "eventData:$event ",
3798
3798
  "type": {
3799
3799
  "definition": {
3800
3800
  "description": null,
@@ -3921,7 +3921,7 @@
3921
3921
  "varName": "ruleId"
3922
3922
  },
3923
3923
  "scanResult": {
3924
- "alias": "ScanResultScanResult: scanResult",
3924
+ "alias": "scanResultScanResult: scanResult",
3925
3925
  "args": {},
3926
3926
  "deprecationReason": null,
3927
3927
  "description": null,
@@ -4112,7 +4112,7 @@
4112
4112
  "name": "Event",
4113
4113
  "non_null": false
4114
4114
  },
4115
- "varName": "Event"
4115
+ "varName": "event"
4116
4116
  },
4117
4117
  "infectionSource": {
4118
4118
  "args": {},
@@ -4215,7 +4215,7 @@
4215
4215
  "varName": "threatReference"
4216
4216
  },
4217
4217
  "type": {
4218
- "alias": "TargetTypeType: type",
4218
+ "alias": "targetTypeType: type",
4219
4219
  "args": {},
4220
4220
  "deprecationReason": null,
4221
4221
  "description": null,
@@ -4288,10 +4288,10 @@
4288
4288
  "name": "IncidentTargetRep",
4289
4289
  "non_null": false
4290
4290
  },
4291
- "varName": "IncidentTargetRep"
4291
+ "varName": "incidentTargetRep"
4292
4292
  },
4293
4293
  "ticket": {
4294
- "alias": "AnomalyEventsTicket: ticket",
4294
+ "alias": "anomalyEventsTicket: ticket",
4295
4295
  "args": {},
4296
4296
  "deprecationReason": null,
4297
4297
  "description": null,
@@ -4319,9 +4319,9 @@
4319
4319
  "isDeprecated": false,
4320
4320
  "name": "timeSeries",
4321
4321
  "path": "story.incident.AnomalyEvents.timeSeries",
4322
- "requestStr": "$IncidentTimeseries:[IncidentTimeseries] ",
4322
+ "requestStr": "$incidentTimeseries:[IncidentTimeseries] ",
4323
4323
  "required": false,
4324
- "responseStr": "timeSeries:$IncidentTimeseries ",
4324
+ "responseStr": "timeSeries:$incidentTimeseries ",
4325
4325
  "type": {
4326
4326
  "definition": {
4327
4327
  "description": null,
@@ -4392,7 +4392,7 @@
4392
4392
  "varName": "info"
4393
4393
  },
4394
4394
  "key": {
4395
- "alias": "TimeseriesKeyKey: key",
4395
+ "alias": "timeseriesKeyKey: key",
4396
4396
  "args": {},
4397
4397
  "deprecationReason": null,
4398
4398
  "description": null,
@@ -4400,9 +4400,9 @@
4400
4400
  "isDeprecated": false,
4401
4401
  "name": "key",
4402
4402
  "path": "story.incident.AnomalyEvents.timeSeries.key",
4403
- "requestStr": "$TimeseriesKey:TimeseriesKey ",
4403
+ "requestStr": "$timeseriesKey:TimeseriesKey ",
4404
4404
  "required": false,
4405
- "responseStr": "key:$TimeseriesKey ",
4405
+ "responseStr": "key:$timeseriesKey ",
4406
4406
  "type": {
4407
4407
  "definition": {
4408
4408
  "description": null,
@@ -4416,9 +4416,9 @@
4416
4416
  "isDeprecated": false,
4417
4417
  "name": "dimensions",
4418
4418
  "path": "story.incident.AnomalyEvents.timeSeries.key.dimensions",
4419
- "requestStr": "$DimensionKey:[DimensionKey] ",
4419
+ "requestStr": "$dimensionKey:[DimensionKey] ",
4420
4420
  "required": false,
4421
- "responseStr": "dimensions:$DimensionKey ",
4421
+ "responseStr": "dimensions:$dimensionKey ",
4422
4422
  "type": {
4423
4423
  "definition": {
4424
4424
  "description": null,
@@ -4481,7 +4481,7 @@
4481
4481
  "name": "DimensionKey",
4482
4482
  "non_null": false
4483
4483
  },
4484
- "varName": "DimensionKey"
4484
+ "varName": "dimensionKey"
4485
4485
  },
4486
4486
  "measureFieldName": {
4487
4487
  "args": {},
@@ -4518,7 +4518,7 @@
4518
4518
  "name": "TimeseriesKey",
4519
4519
  "non_null": false
4520
4520
  },
4521
- "varName": "TimeseriesKey"
4521
+ "varName": "timeseriesKey"
4522
4522
  },
4523
4523
  "label": {
4524
4524
  "args": {},
@@ -4562,7 +4562,7 @@
4562
4562
  "varName": "sum"
4563
4563
  },
4564
4564
  "units": {
4565
- "alias": "UnitTypeUnits: units",
4565
+ "alias": "unitTypeUnits: units",
4566
4566
  "args": {},
4567
4567
  "deprecationReason": null,
4568
4568
  "description": "Identifies what unit of data this timeseries represents. Note that toRate is only available for particular types\nof data to make sense.",
@@ -4676,10 +4676,10 @@
4676
4676
  "name": "IncidentTimeseries",
4677
4677
  "non_null": false
4678
4678
  },
4679
- "varName": "IncidentTimeseries"
4679
+ "varName": "incidentTimeseries"
4680
4680
  },
4681
4681
  "user": {
4682
- "alias": "UserRef: user",
4682
+ "alias": "userRef: user",
4683
4683
  "args": {},
4684
4684
  "deprecationReason": null,
4685
4685
  "description": null,
@@ -4687,9 +4687,9 @@
4687
4687
  "isDeprecated": false,
4688
4688
  "name": "user",
4689
4689
  "path": "story.incident.AnomalyEvents.user",
4690
- "requestStr": "$UserRef:UserRef ",
4690
+ "requestStr": "$userRef:UserRef ",
4691
4691
  "required": false,
4692
- "responseStr": "user:$UserRef ",
4692
+ "responseStr": "user:$userRef ",
4693
4693
  "type": {
4694
4694
  "definition": {
4695
4695
  "description": null,
@@ -4751,10 +4751,10 @@
4751
4751
  "name": "UserRef",
4752
4752
  "non_null": false
4753
4753
  },
4754
- "varName": "UserRef"
4754
+ "varName": "userRef"
4755
4755
  },
4756
4756
  "vendor": {
4757
- "alias": "AnomalyEventsVendor: vendor",
4757
+ "alias": "anomalyEventsVendor: vendor",
4758
4758
  "args": {},
4759
4759
  "deprecationReason": null,
4760
4760
  "description": null,
@@ -4810,7 +4810,7 @@
4810
4810
  "enumValues": null,
4811
4811
  "fields": {
4812
4812
  "analystFeedback": {
4813
- "alias": "AnalystFeedback: analystFeedback",
4813
+ "alias": "analystFeedback: analystFeedback",
4814
4814
  "args": {},
4815
4815
  "deprecationReason": null,
4816
4816
  "description": null,
@@ -4818,9 +4818,9 @@
4818
4818
  "isDeprecated": false,
4819
4819
  "name": "analystFeedback",
4820
4820
  "path": "story.incident.AnomalyStats.analystFeedback",
4821
- "requestStr": "$AnalystFeedback:AnalystFeedback ",
4821
+ "requestStr": "$analystFeedback:AnalystFeedback ",
4822
4822
  "required": false,
4823
- "responseStr": "analystFeedback:$AnalystFeedback ",
4823
+ "responseStr": "analystFeedback:$analystFeedback ",
4824
4824
  "type": {
4825
4825
  "definition": {
4826
4826
  "description": null,
@@ -4924,9 +4924,9 @@
4924
4924
  "isDeprecated": false,
4925
4925
  "name": "threatType",
4926
4926
  "path": "story.incident.AnomalyStats.analystFeedback.threatType",
4927
- "requestStr": "$AnalystFeedbackThreatType:AnalystFeedbackThreatType ",
4927
+ "requestStr": "$analystFeedbackThreatType:AnalystFeedbackThreatType ",
4928
4928
  "required": false,
4929
- "responseStr": "threatType:$AnalystFeedbackThreatType ",
4929
+ "responseStr": "threatType:$analystFeedbackThreatType ",
4930
4930
  "type": {
4931
4931
  "definition": {
4932
4932
  "description": null,
@@ -5006,7 +5006,7 @@
5006
5006
  "name": "AnalystFeedbackThreatType",
5007
5007
  "non_null": false
5008
5008
  },
5009
- "varName": "AnalystFeedbackThreatType"
5009
+ "varName": "analystFeedbackThreatType"
5010
5010
  },
5011
5011
  "verdict": {
5012
5012
  "args": {},
@@ -5078,7 +5078,7 @@
5078
5078
  "name": "AnalystFeedback",
5079
5079
  "non_null": false
5080
5080
  },
5081
- "varName": "AnalystFeedback"
5081
+ "varName": "analystFeedback"
5082
5082
  },
5083
5083
  "breakdownField": {
5084
5084
  "args": {},
@@ -5124,7 +5124,7 @@
5124
5124
  "varName": "clientClass"
5125
5125
  },
5126
5126
  "connectionType": {
5127
- "alias": "AnomalyStatsConnectionType: connectionType",
5127
+ "alias": "anomalyStatsConnectionType: connectionType",
5128
5128
  "args": {},
5129
5129
  "deprecationReason": null,
5130
5130
  "description": null,
@@ -5175,7 +5175,7 @@
5175
5175
  "varName": "connectionType"
5176
5176
  },
5177
5177
  "criticality": {
5178
- "alias": "AnomalyStatsCriticality: criticality",
5178
+ "alias": "anomalyStatsCriticality: criticality",
5179
5179
  "args": {},
5180
5180
  "deprecationReason": null,
5181
5181
  "description": null,
@@ -5196,7 +5196,7 @@
5196
5196
  "varName": "criticality"
5197
5197
  },
5198
5198
  "description": {
5199
- "alias": "AnomalyStatsDescription: description",
5199
+ "alias": "anomalyStatsDescription: description",
5200
5200
  "args": {},
5201
5201
  "deprecationReason": null,
5202
5202
  "description": null,
@@ -5264,9 +5264,9 @@
5264
5264
  "isDeprecated": false,
5265
5265
  "name": "drillDownFilter",
5266
5266
  "path": "story.incident.AnomalyStats.drillDownFilter",
5267
- "requestStr": "$StoryDrillDownFilter:[StoryDrillDownFilter] ",
5267
+ "requestStr": "$storyDrillDownFilter:[StoryDrillDownFilter] ",
5268
5268
  "required": false,
5269
- "responseStr": "drillDownFilter:$StoryDrillDownFilter ",
5269
+ "responseStr": "drillDownFilter:$storyDrillDownFilter ",
5270
5270
  "type": {
5271
5271
  "definition": {
5272
5272
  "description": null,
@@ -5330,10 +5330,10 @@
5330
5330
  "name": "StoryDrillDownFilter",
5331
5331
  "non_null": false
5332
5332
  },
5333
- "varName": "StoryDrillDownFilter"
5333
+ "varName": "storyDrillDownFilter"
5334
5334
  },
5335
5335
  "engineType": {
5336
- "alias": "AnomalyStatsEngineType: engineType",
5336
+ "alias": "anomalyStatsEngineType: engineType",
5337
5337
  "args": {},
5338
5338
  "deprecationReason": null,
5339
5339
  "description": null,
@@ -5403,9 +5403,9 @@
5403
5403
  "isDeprecated": false,
5404
5404
  "name": "extra",
5405
5405
  "path": "story.incident.AnomalyStats.extra",
5406
- "requestStr": "$Extra:[Extra] ",
5406
+ "requestStr": "$extra:[Extra] ",
5407
5407
  "required": false,
5408
- "responseStr": "extra:$Extra ",
5408
+ "responseStr": "extra:$extra ",
5409
5409
  "type": {
5410
5410
  "definition": {
5411
5411
  "description": null,
@@ -5490,10 +5490,10 @@
5490
5490
  "name": "Extra",
5491
5491
  "non_null": false
5492
5492
  },
5493
- "varName": "Extra"
5493
+ "varName": "extra"
5494
5494
  },
5495
5495
  "firstSignal": {
5496
- "alias": "AnomalyStatsFirstSignal: firstSignal",
5496
+ "alias": "anomalyStatsFirstSignal: firstSignal",
5497
5497
  "args": {},
5498
5498
  "deprecationReason": null,
5499
5499
  "description": null,
@@ -5522,9 +5522,9 @@
5522
5522
  "isDeprecated": false,
5523
5523
  "name": "gaussian",
5524
5524
  "path": "story.incident.AnomalyStats.gaussian",
5525
- "requestStr": "$Gaussian:Gaussian ",
5525
+ "requestStr": "$gaussian:Gaussian ",
5526
5526
  "required": false,
5527
- "responseStr": "gaussian:$Gaussian ",
5527
+ "responseStr": "gaussian:$gaussian ",
5528
5528
  "type": {
5529
5529
  "definition": {
5530
5530
  "description": null,
@@ -5644,10 +5644,10 @@
5644
5644
  "name": "Gaussian",
5645
5645
  "non_null": false
5646
5646
  },
5647
- "varName": "Gaussian"
5647
+ "varName": "gaussian"
5648
5648
  },
5649
5649
  "id": {
5650
- "alias": "AnomalyStatsId: id",
5650
+ "alias": "anomalyStatsId: id",
5651
5651
  "args": {},
5652
5652
  "deprecationReason": null,
5653
5653
  "description": null,
@@ -5669,7 +5669,7 @@
5669
5669
  "varName": "id"
5670
5670
  },
5671
5671
  "indication": {
5672
- "alias": "AnomalyStatsIndication: indication",
5672
+ "alias": "anomalyStatsIndication: indication",
5673
5673
  "args": {},
5674
5674
  "deprecationReason": null,
5675
5675
  "description": null,
@@ -5691,7 +5691,7 @@
5691
5691
  "varName": "indication"
5692
5692
  },
5693
5693
  "lastSignal": {
5694
- "alias": "AnomalyStatsLastSignal: lastSignal",
5694
+ "alias": "anomalyStatsLastSignal: lastSignal",
5695
5695
  "args": {},
5696
5696
  "deprecationReason": null,
5697
5697
  "description": null,
@@ -5760,9 +5760,9 @@
5760
5760
  "isDeprecated": false,
5761
5761
  "name": "metric",
5762
5762
  "path": "story.incident.AnomalyStats.metric",
5763
- "requestStr": "$Metric:Metric ",
5763
+ "requestStr": "$metric:Metric ",
5764
5764
  "required": false,
5765
- "responseStr": "metric:$Metric ",
5765
+ "responseStr": "metric:$metric ",
5766
5766
  "type": {
5767
5767
  "definition": {
5768
5768
  "description": null,
@@ -5824,7 +5824,7 @@
5824
5824
  "name": "Metric",
5825
5825
  "non_null": false
5826
5826
  },
5827
- "varName": "Metric"
5827
+ "varName": "metric"
5828
5828
  },
5829
5829
  "metricDetails": {
5830
5830
  "args": {},
@@ -5834,9 +5834,9 @@
5834
5834
  "isDeprecated": false,
5835
5835
  "name": "metricDetails",
5836
5836
  "path": "story.incident.AnomalyStats.metricDetails",
5837
- "requestStr": "$MetricDetails:MetricDetails ",
5837
+ "requestStr": "$metricDetails:MetricDetails ",
5838
5838
  "required": false,
5839
- "responseStr": "metricDetails:$MetricDetails ",
5839
+ "responseStr": "metricDetails:$metricDetails ",
5840
5840
  "type": {
5841
5841
  "definition": {
5842
5842
  "description": null,
@@ -5898,7 +5898,7 @@
5898
5898
  "name": "MetricDetails",
5899
5899
  "non_null": false
5900
5900
  },
5901
- "varName": "MetricDetails"
5901
+ "varName": "metricDetails"
5902
5902
  },
5903
5903
  "mitres": {
5904
5904
  "args": {},
@@ -5908,9 +5908,9 @@
5908
5908
  "isDeprecated": false,
5909
5909
  "name": "mitres",
5910
5910
  "path": "story.incident.AnomalyStats.mitres",
5911
- "requestStr": "$Mitre:[Mitre] ",
5911
+ "requestStr": "$mitre:[Mitre] ",
5912
5912
  "required": false,
5913
- "responseStr": "mitres:$Mitre ",
5913
+ "responseStr": "mitres:$mitre ",
5914
5914
  "type": {
5915
5915
  "definition": {
5916
5916
  "description": null,
@@ -5972,7 +5972,7 @@
5972
5972
  "name": "Mitre",
5973
5973
  "non_null": false
5974
5974
  },
5975
- "varName": "Mitre"
5975
+ "varName": "mitre"
5976
5976
  },
5977
5977
  "os": {
5978
5978
  "args": {},
@@ -5995,7 +5995,7 @@
5995
5995
  "varName": "os"
5996
5996
  },
5997
5997
  "predictedThreatType": {
5998
- "alias": "AnomalyStatsPredictedThreatType: predictedThreatType",
5998
+ "alias": "anomalyStatsPredictedThreatType: predictedThreatType",
5999
5999
  "args": {},
6000
6000
  "deprecationReason": null,
6001
6001
  "description": null,
@@ -6016,7 +6016,7 @@
6016
6016
  "varName": "predictedThreatType"
6017
6017
  },
6018
6018
  "predictedVerdict": {
6019
- "alias": "AnomalyStatsPredictedVerdict: predictedVerdict",
6019
+ "alias": "anomalyStatsPredictedVerdict: predictedVerdict",
6020
6020
  "args": {},
6021
6021
  "deprecationReason": null,
6022
6022
  "description": null,
@@ -6073,7 +6073,7 @@
6073
6073
  "varName": "predictedVerdict"
6074
6074
  },
6075
6075
  "producer": {
6076
- "alias": "AnomalyStatsProducer: producer",
6076
+ "alias": "anomalyStatsProducer: producer",
6077
6077
  "args": {},
6078
6078
  "deprecationReason": null,
6079
6079
  "description": null,
@@ -6161,7 +6161,7 @@
6161
6161
  "varName": "producer"
6162
6162
  },
6163
6163
  "producerName": {
6164
- "alias": "AnomalyStatsProducerName: producerName",
6164
+ "alias": "anomalyStatsProducerName: producerName",
6165
6165
  "args": {},
6166
6166
  "deprecationReason": null,
6167
6167
  "description": null,
@@ -6183,7 +6183,7 @@
6183
6183
  "varName": "producerName"
6184
6184
  },
6185
6185
  "queryName": {
6186
- "alias": "AnomalyStatsQueryName: queryName",
6186
+ "alias": "anomalyStatsQueryName: queryName",
6187
6187
  "args": {},
6188
6188
  "deprecationReason": null,
6189
6189
  "description": null,
@@ -6204,7 +6204,7 @@
6204
6204
  "varName": "queryName"
6205
6205
  },
6206
6206
  "research": {
6207
- "alias": "AnomalyStatsResearch: research",
6207
+ "alias": "anomalyStatsResearch: research",
6208
6208
  "args": {},
6209
6209
  "deprecationReason": null,
6210
6210
  "description": null,
@@ -6254,9 +6254,9 @@
6254
6254
  "isDeprecated": false,
6255
6255
  "name": "similarStoriesData",
6256
6256
  "path": "story.incident.AnomalyStats.similarStoriesData",
6257
- "requestStr": "$SimilarStoryData:[SimilarStoryData]! ",
6257
+ "requestStr": "$similarStoryData:[SimilarStoryData]! ",
6258
6258
  "required": true,
6259
- "responseStr": "similarStoriesData:$SimilarStoryData ",
6259
+ "responseStr": "similarStoriesData:$similarStoryData ",
6260
6260
  "type": {
6261
6261
  "definition": {
6262
6262
  "description": null,
@@ -6399,10 +6399,10 @@
6399
6399
  "name": "SimilarStoryData",
6400
6400
  "non_null": false
6401
6401
  },
6402
- "varName": "SimilarStoryData"
6402
+ "varName": "similarStoryData"
6403
6403
  },
6404
6404
  "site": {
6405
- "alias": "SiteRef: site",
6405
+ "alias": "siteRef: site",
6406
6406
  "args": {},
6407
6407
  "deprecationReason": null,
6408
6408
  "description": null,
@@ -6410,9 +6410,9 @@
6410
6410
  "isDeprecated": false,
6411
6411
  "name": "site",
6412
6412
  "path": "story.incident.AnomalyStats.site",
6413
- "requestStr": "$SiteRef:SiteRef ",
6413
+ "requestStr": "$siteRef:SiteRef ",
6414
6414
  "required": false,
6415
- "responseStr": "site:$SiteRef ",
6415
+ "responseStr": "site:$siteRef ",
6416
6416
  "type": {
6417
6417
  "definition": {
6418
6418
  "description": null,
@@ -6474,10 +6474,10 @@
6474
6474
  "name": "SiteRef",
6475
6475
  "non_null": false
6476
6476
  },
6477
- "varName": "SiteRef"
6477
+ "varName": "siteRef"
6478
6478
  },
6479
6479
  "siteName": {
6480
- "alias": "AnomalyStatsSiteName: siteName",
6480
+ "alias": "anomalyStatsSiteName: siteName",
6481
6481
  "args": {},
6482
6482
  "deprecationReason": null,
6483
6483
  "description": null,
@@ -6498,7 +6498,7 @@
6498
6498
  "varName": "siteName"
6499
6499
  },
6500
6500
  "source": {
6501
- "alias": "AnomalyStatsSource: source",
6501
+ "alias": "anomalyStatsSource: source",
6502
6502
  "args": {},
6503
6503
  "deprecationReason": null,
6504
6504
  "description": null,
@@ -6519,7 +6519,7 @@
6519
6519
  "varName": "source"
6520
6520
  },
6521
6521
  "sourceIp": {
6522
- "alias": "AnomalyStatsSourceIp: sourceIp",
6522
+ "alias": "anomalyStatsSourceIp: sourceIp",
6523
6523
  "args": {},
6524
6524
  "deprecationReason": null,
6525
6525
  "description": null,
@@ -6560,7 +6560,7 @@
6560
6560
  "varName": "srcSiteId"
6561
6561
  },
6562
6562
  "status": {
6563
- "alias": "AnomalyStatsStatus: status",
6563
+ "alias": "anomalyStatsStatus: status",
6564
6564
  "args": {},
6565
6565
  "deprecationReason": null,
6566
6566
  "description": null,
@@ -6629,7 +6629,7 @@
6629
6629
  "varName": "status"
6630
6630
  },
6631
6631
  "storyDuration": {
6632
- "alias": "AnomalyStatsStoryDuration: storyDuration",
6632
+ "alias": "anomalyStatsStoryDuration: storyDuration",
6633
6633
  "args": {},
6634
6634
  "deprecationReason": null,
6635
6635
  "description": null,
@@ -6677,9 +6677,9 @@
6677
6677
  "isDeprecated": false,
6678
6678
  "name": "targets",
6679
6679
  "path": "story.incident.AnomalyStats.targets",
6680
- "requestStr": "$IncidentTargetRep:[IncidentTargetRep]! ",
6680
+ "requestStr": "$incidentTargetRep:[IncidentTargetRep]! ",
6681
6681
  "required": true,
6682
- "responseStr": "targets:$IncidentTargetRep ",
6682
+ "responseStr": "targets:$incidentTargetRep ",
6683
6683
  "type": {
6684
6684
  "definition": {
6685
6685
  "description": null,
@@ -6806,7 +6806,7 @@
6806
6806
  "varName": "engines"
6807
6807
  },
6808
6808
  "eventData": {
6809
- "alias": "EventEventData: eventData",
6809
+ "alias": "eventEventData: eventData",
6810
6810
  "args": {},
6811
6811
  "deprecationReason": null,
6812
6812
  "description": null,
@@ -6814,9 +6814,9 @@
6814
6814
  "isDeprecated": false,
6815
6815
  "name": "eventData",
6816
6816
  "path": "story.incident.AnomalyStats.targets.eventData",
6817
- "requestStr": "$Event:[Event]! ",
6817
+ "requestStr": "$event:[Event]! ",
6818
6818
  "required": true,
6819
- "responseStr": "eventData:$Event ",
6819
+ "responseStr": "eventData:$event ",
6820
6820
  "type": {
6821
6821
  "definition": {
6822
6822
  "description": null,
@@ -6943,7 +6943,7 @@
6943
6943
  "varName": "ruleId"
6944
6944
  },
6945
6945
  "scanResult": {
6946
- "alias": "ScanResultScanResult: scanResult",
6946
+ "alias": "scanResultScanResult: scanResult",
6947
6947
  "args": {},
6948
6948
  "deprecationReason": null,
6949
6949
  "description": null,
@@ -7134,7 +7134,7 @@
7134
7134
  "name": "Event",
7135
7135
  "non_null": false
7136
7136
  },
7137
- "varName": "Event"
7137
+ "varName": "event"
7138
7138
  },
7139
7139
  "infectionSource": {
7140
7140
  "args": {},
@@ -7237,7 +7237,7 @@
7237
7237
  "varName": "threatReference"
7238
7238
  },
7239
7239
  "type": {
7240
- "alias": "TargetTypeType: type",
7240
+ "alias": "targetTypeType: type",
7241
7241
  "args": {},
7242
7242
  "deprecationReason": null,
7243
7243
  "description": null,
@@ -7310,10 +7310,10 @@
7310
7310
  "name": "IncidentTargetRep",
7311
7311
  "non_null": false
7312
7312
  },
7313
- "varName": "IncidentTargetRep"
7313
+ "varName": "incidentTargetRep"
7314
7314
  },
7315
7315
  "ticket": {
7316
- "alias": "AnomalyStatsTicket: ticket",
7316
+ "alias": "anomalyStatsTicket: ticket",
7317
7317
  "args": {},
7318
7318
  "deprecationReason": null,
7319
7319
  "description": null,
@@ -7341,9 +7341,9 @@
7341
7341
  "isDeprecated": false,
7342
7342
  "name": "timeSeries",
7343
7343
  "path": "story.incident.AnomalyStats.timeSeries",
7344
- "requestStr": "$IncidentTimeseries:[IncidentTimeseries] ",
7344
+ "requestStr": "$incidentTimeseries:[IncidentTimeseries] ",
7345
7345
  "required": false,
7346
- "responseStr": "timeSeries:$IncidentTimeseries ",
7346
+ "responseStr": "timeSeries:$incidentTimeseries ",
7347
7347
  "type": {
7348
7348
  "definition": {
7349
7349
  "description": null,
@@ -7414,7 +7414,7 @@
7414
7414
  "varName": "info"
7415
7415
  },
7416
7416
  "key": {
7417
- "alias": "TimeseriesKeyKey: key",
7417
+ "alias": "timeseriesKeyKey: key",
7418
7418
  "args": {},
7419
7419
  "deprecationReason": null,
7420
7420
  "description": null,
@@ -7422,9 +7422,9 @@
7422
7422
  "isDeprecated": false,
7423
7423
  "name": "key",
7424
7424
  "path": "story.incident.AnomalyStats.timeSeries.key",
7425
- "requestStr": "$TimeseriesKey:TimeseriesKey ",
7425
+ "requestStr": "$timeseriesKey:TimeseriesKey ",
7426
7426
  "required": false,
7427
- "responseStr": "key:$TimeseriesKey ",
7427
+ "responseStr": "key:$timeseriesKey ",
7428
7428
  "type": {
7429
7429
  "definition": {
7430
7430
  "description": null,
@@ -7438,9 +7438,9 @@
7438
7438
  "isDeprecated": false,
7439
7439
  "name": "dimensions",
7440
7440
  "path": "story.incident.AnomalyStats.timeSeries.key.dimensions",
7441
- "requestStr": "$DimensionKey:[DimensionKey] ",
7441
+ "requestStr": "$dimensionKey:[DimensionKey] ",
7442
7442
  "required": false,
7443
- "responseStr": "dimensions:$DimensionKey ",
7443
+ "responseStr": "dimensions:$dimensionKey ",
7444
7444
  "type": {
7445
7445
  "definition": {
7446
7446
  "description": null,
@@ -7503,7 +7503,7 @@
7503
7503
  "name": "DimensionKey",
7504
7504
  "non_null": false
7505
7505
  },
7506
- "varName": "DimensionKey"
7506
+ "varName": "dimensionKey"
7507
7507
  },
7508
7508
  "measureFieldName": {
7509
7509
  "args": {},
@@ -7540,7 +7540,7 @@
7540
7540
  "name": "TimeseriesKey",
7541
7541
  "non_null": false
7542
7542
  },
7543
- "varName": "TimeseriesKey"
7543
+ "varName": "timeseriesKey"
7544
7544
  },
7545
7545
  "label": {
7546
7546
  "args": {},
@@ -7584,7 +7584,7 @@
7584
7584
  "varName": "sum"
7585
7585
  },
7586
7586
  "units": {
7587
- "alias": "UnitTypeUnits: units",
7587
+ "alias": "unitTypeUnits: units",
7588
7588
  "args": {},
7589
7589
  "deprecationReason": null,
7590
7590
  "description": "Identifies what unit of data this timeseries represents. Note that toRate is only available for particular types\nof data to make sense.",
@@ -7698,10 +7698,10 @@
7698
7698
  "name": "IncidentTimeseries",
7699
7699
  "non_null": false
7700
7700
  },
7701
- "varName": "IncidentTimeseries"
7701
+ "varName": "incidentTimeseries"
7702
7702
  },
7703
7703
  "user": {
7704
- "alias": "UserRef: user",
7704
+ "alias": "userRef: user",
7705
7705
  "args": {},
7706
7706
  "deprecationReason": null,
7707
7707
  "description": null,
@@ -7709,9 +7709,9 @@
7709
7709
  "isDeprecated": false,
7710
7710
  "name": "user",
7711
7711
  "path": "story.incident.AnomalyStats.user",
7712
- "requestStr": "$UserRef:UserRef ",
7712
+ "requestStr": "$userRef:UserRef ",
7713
7713
  "required": false,
7714
- "responseStr": "user:$UserRef ",
7714
+ "responseStr": "user:$userRef ",
7715
7715
  "type": {
7716
7716
  "definition": {
7717
7717
  "description": null,
@@ -7773,10 +7773,10 @@
7773
7773
  "name": "UserRef",
7774
7774
  "non_null": false
7775
7775
  },
7776
- "varName": "UserRef"
7776
+ "varName": "userRef"
7777
7777
  },
7778
7778
  "vendor": {
7779
- "alias": "AnomalyStatsVendor: vendor",
7779
+ "alias": "anomalyStatsVendor: vendor",
7780
7780
  "args": {},
7781
7781
  "deprecationReason": null,
7782
7782
  "description": null,
@@ -7839,16 +7839,16 @@
7839
7839
  "isDeprecated": false,
7840
7840
  "name": "alerts",
7841
7841
  "path": "story.incident.CatoEndpoint.alerts",
7842
- "requestStr": "$CatoEndpointAlert:[CatoEndpointAlert]! ",
7842
+ "requestStr": "$catoEndpointAlert:[CatoEndpointAlert]! ",
7843
7843
  "required": true,
7844
- "responseStr": "alerts:$CatoEndpointAlert ",
7844
+ "responseStr": "alerts:$catoEndpointAlert ",
7845
7845
  "type": {
7846
7846
  "definition": {
7847
7847
  "description": null,
7848
7848
  "enumValues": null,
7849
7849
  "fields": {
7850
7850
  "activities": {
7851
- "alias": "CatoActivityActivities: activities",
7851
+ "alias": "catoActivityActivities: activities",
7852
7852
  "args": {},
7853
7853
  "deprecationReason": null,
7854
7854
  "description": "Unique Cato IDs for the activities related to the alert",
@@ -7856,9 +7856,9 @@
7856
7856
  "isDeprecated": false,
7857
7857
  "name": "activities",
7858
7858
  "path": "story.incident.CatoEndpoint.alerts.activities",
7859
- "requestStr": "$CatoActivity:[CatoActivity]! ",
7859
+ "requestStr": "$catoActivity:[CatoActivity]! ",
7860
7860
  "required": true,
7861
- "responseStr": "activities:$CatoActivity ",
7861
+ "responseStr": "activities:$catoActivity ",
7862
7862
  "type": {
7863
7863
  "definition": {
7864
7864
  "description": null,
@@ -7944,7 +7944,7 @@
7944
7944
  "name": "CatoActivity",
7945
7945
  "non_null": false
7946
7946
  },
7947
- "varName": "CatoActivity"
7947
+ "varName": "catoActivity"
7948
7948
  },
7949
7949
  "createdDateTime": {
7950
7950
  "args": {},
@@ -8027,7 +8027,7 @@
8027
8027
  "varName": "endpointProtectionProfile"
8028
8028
  },
8029
8029
  "engineType": {
8030
- "alias": "CatoEndpointEngineTypeEngineType: engineType",
8030
+ "alias": "catoEndpointEngineTypeEngineType: engineType",
8031
8031
  "args": {},
8032
8032
  "deprecationReason": null,
8033
8033
  "description": "Enum for the EPP engine related to this story",
@@ -8093,7 +8093,7 @@
8093
8093
  "varName": "id"
8094
8094
  },
8095
8095
  "mitreSubTechnique": {
8096
- "alias": "MitreMitreSubTechnique: mitreSubTechnique",
8096
+ "alias": "mitreMitreSubTechnique: mitreSubTechnique",
8097
8097
  "args": {},
8098
8098
  "deprecationReason": null,
8099
8099
  "description": "MITRE ATT&CK\u00ae sub-technique for the threat",
@@ -8101,9 +8101,9 @@
8101
8101
  "isDeprecated": false,
8102
8102
  "name": "mitreSubTechnique",
8103
8103
  "path": "story.incident.CatoEndpoint.alerts.mitreSubTechnique",
8104
- "requestStr": "$Mitre:[Mitre]! ",
8104
+ "requestStr": "$mitre:[Mitre]! ",
8105
8105
  "required": true,
8106
- "responseStr": "mitreSubTechnique:$Mitre ",
8106
+ "responseStr": "mitreSubTechnique:$mitre ",
8107
8107
  "type": {
8108
8108
  "definition": {
8109
8109
  "description": null,
@@ -8166,10 +8166,10 @@
8166
8166
  "name": "Mitre",
8167
8167
  "non_null": false
8168
8168
  },
8169
- "varName": "Mitre"
8169
+ "varName": "mitre"
8170
8170
  },
8171
8171
  "mitreTechnique": {
8172
- "alias": "MitreMitreTechnique: mitreTechnique",
8172
+ "alias": "mitreMitreTechnique: mitreTechnique",
8173
8173
  "args": {},
8174
8174
  "deprecationReason": null,
8175
8175
  "description": "MITRE ATT&CK\u00ae technique for the threat",
@@ -8177,9 +8177,9 @@
8177
8177
  "isDeprecated": false,
8178
8178
  "name": "mitreTechnique",
8179
8179
  "path": "story.incident.CatoEndpoint.alerts.mitreTechnique",
8180
- "requestStr": "$Mitre:[Mitre]! ",
8180
+ "requestStr": "$mitre:[Mitre]! ",
8181
8181
  "required": true,
8182
- "responseStr": "mitreTechnique:$Mitre ",
8182
+ "responseStr": "mitreTechnique:$mitre ",
8183
8183
  "type": {
8184
8184
  "definition": {
8185
8185
  "description": null,
@@ -8242,10 +8242,10 @@
8242
8242
  "name": "Mitre",
8243
8243
  "non_null": false
8244
8244
  },
8245
- "varName": "Mitre"
8245
+ "varName": "mitre"
8246
8246
  },
8247
8247
  "resources": {
8248
- "alias": "CatoResourceResources: resources",
8248
+ "alias": "catoResourceResources: resources",
8249
8249
  "args": {},
8250
8250
  "deprecationReason": null,
8251
8251
  "description": "Data for the remediation status of the alert",
@@ -8253,9 +8253,9 @@
8253
8253
  "isDeprecated": false,
8254
8254
  "name": "resources",
8255
8255
  "path": "story.incident.CatoEndpoint.alerts.resources",
8256
- "requestStr": "$CatoResource:[CatoResource]! ",
8256
+ "requestStr": "$catoResource:[CatoResource]! ",
8257
8257
  "required": true,
8258
- "responseStr": "resources:$CatoResource ",
8258
+ "responseStr": "resources:$catoResource ",
8259
8259
  "type": {
8260
8260
  "definition": {
8261
8261
  "description": null,
@@ -8303,7 +8303,7 @@
8303
8303
  "varName": "id"
8304
8304
  },
8305
8305
  "remediationStatus": {
8306
- "alias": "RemediationStatusEnumRemediationStatus: remediationStatus",
8306
+ "alias": "remediationStatusEnumRemediationStatus: remediationStatus",
8307
8307
  "args": {},
8308
8308
  "deprecationReason": null,
8309
8309
  "description": "Enum for the remediation status associated with this resource",
@@ -8466,7 +8466,7 @@
8466
8466
  "enumValues": null,
8467
8467
  "fields": {
8468
8468
  "createdDateTime": {
8469
- "alias": "CatoFileResourceCreatedDateTime: createdDateTime",
8469
+ "alias": "catoFileResourceCreatedDateTime: createdDateTime",
8470
8470
  "args": {},
8471
8471
  "deprecationReason": null,
8472
8472
  "description": "Timestamp that the this file resource was used",
@@ -8544,9 +8544,9 @@
8544
8544
  "isDeprecated": false,
8545
8545
  "name": "fileDetails",
8546
8546
  "path": "story.incident.CatoEndpoint.alerts.resources.CatoFileResource.fileDetails",
8547
- "requestStr": "$FileDetails:FileDetails ",
8547
+ "requestStr": "$fileDetails:FileDetails ",
8548
8548
  "required": false,
8549
- "responseStr": "fileDetails:$FileDetails ",
8549
+ "responseStr": "fileDetails:$fileDetails ",
8550
8550
  "type": {
8551
8551
  "definition": {
8552
8552
  "description": null,
@@ -8746,10 +8746,10 @@
8746
8746
  "name": "FileDetails",
8747
8747
  "non_null": false
8748
8748
  },
8749
- "varName": "FileDetails"
8749
+ "varName": "fileDetails"
8750
8750
  },
8751
8751
  "id": {
8752
- "alias": "CatoFileResourceId: id",
8752
+ "alias": "catoFileResourceId: id",
8753
8753
  "args": {},
8754
8754
  "deprecationReason": null,
8755
8755
  "description": "Unique Cato ID for this file resource",
@@ -8771,7 +8771,7 @@
8771
8771
  "varName": "id"
8772
8772
  },
8773
8773
  "remediationStatus": {
8774
- "alias": "CatoFileResourceRemediationStatus: remediationStatus",
8774
+ "alias": "catoFileResourceRemediationStatus: remediationStatus",
8775
8775
  "args": {},
8776
8776
  "deprecationReason": null,
8777
8777
  "description": "Enum for the remediation status associated with this file resource",
@@ -8935,7 +8935,7 @@
8935
8935
  "enumValues": null,
8936
8936
  "fields": {
8937
8937
  "createdDateTime": {
8938
- "alias": "CatoProcessResourceCreatedDateTime: createdDateTime",
8938
+ "alias": "catoProcessResourceCreatedDateTime: createdDateTime",
8939
8939
  "args": {},
8940
8940
  "deprecationReason": null,
8941
8941
  "description": "Timestamp that the this resource was used",
@@ -8956,7 +8956,7 @@
8956
8956
  "varName": "createdDateTime"
8957
8957
  },
8958
8958
  "id": {
8959
- "alias": "CatoProcessResourceId: id",
8959
+ "alias": "catoProcessResourceId: id",
8960
8960
  "args": {},
8961
8961
  "deprecationReason": null,
8962
8962
  "description": "Unique Cato ID for this resource",
@@ -8985,9 +8985,9 @@
8985
8985
  "isDeprecated": false,
8986
8986
  "name": "imageFile",
8987
8987
  "path": "story.incident.CatoEndpoint.alerts.resources.CatoProcessResource.imageFile",
8988
- "requestStr": "$FileDetails:FileDetails ",
8988
+ "requestStr": "$fileDetails:FileDetails ",
8989
8989
  "required": false,
8990
- "responseStr": "imageFile:$FileDetails ",
8990
+ "responseStr": "imageFile:$fileDetails ",
8991
8991
  "type": {
8992
8992
  "definition": {
8993
8993
  "description": null,
@@ -9187,7 +9187,7 @@
9187
9187
  "name": "FileDetails",
9188
9188
  "non_null": false
9189
9189
  },
9190
- "varName": "FileDetails"
9190
+ "varName": "fileDetails"
9191
9191
  },
9192
9192
  "processCommandLine": {
9193
9193
  "args": {},
@@ -9231,7 +9231,7 @@
9231
9231
  "varName": "processId"
9232
9232
  },
9233
9233
  "remediationStatus": {
9234
- "alias": "CatoProcessResourceRemediationStatus: remediationStatus",
9234
+ "alias": "catoProcessResourceRemediationStatus: remediationStatus",
9235
9235
  "args": {},
9236
9236
  "deprecationReason": null,
9237
9237
  "description": "Enum for the remediation status associated with this resource",
@@ -9391,9 +9391,9 @@
9391
9391
  "isDeprecated": false,
9392
9392
  "name": "userAccount",
9393
9393
  "path": "story.incident.CatoEndpoint.alerts.resources.CatoProcessResource.userAccount",
9394
- "requestStr": "$EndpointUser:EndpointUser ",
9394
+ "requestStr": "$endpointUser:EndpointUser ",
9395
9395
  "required": false,
9396
- "responseStr": "userAccount:$EndpointUser ",
9396
+ "responseStr": "userAccount:$endpointUser ",
9397
9397
  "type": {
9398
9398
  "definition": {
9399
9399
  "description": null,
@@ -9452,7 +9452,7 @@
9452
9452
  "enumValues": null,
9453
9453
  "fields": {
9454
9454
  "id": {
9455
- "alias": "CatoEndpointUserId: id",
9455
+ "alias": "catoEndpointUserId: id",
9456
9456
  "args": {},
9457
9457
  "deprecationReason": null,
9458
9458
  "description": "ID for the user",
@@ -9474,7 +9474,7 @@
9474
9474
  "varName": "id"
9475
9475
  },
9476
9476
  "name": {
9477
- "alias": "CatoEndpointUserName: name",
9477
+ "alias": "catoEndpointUserName: name",
9478
9478
  "args": {},
9479
9479
  "deprecationReason": null,
9480
9480
  "description": "Username for the user whose activity generated the indication",
@@ -9547,7 +9547,7 @@
9547
9547
  "varName": "domainName"
9548
9548
  },
9549
9549
  "id": {
9550
- "alias": "MicrosoftEndpointUserId: id",
9550
+ "alias": "microsoftEndpointUserId: id",
9551
9551
  "args": {},
9552
9552
  "deprecationReason": null,
9553
9553
  "description": null,
@@ -9569,7 +9569,7 @@
9569
9569
  "varName": "id"
9570
9570
  },
9571
9571
  "name": {
9572
- "alias": "MicrosoftEndpointUserName: name",
9572
+ "alias": "microsoftEndpointUserName: name",
9573
9573
  "args": {},
9574
9574
  "deprecationReason": null,
9575
9575
  "description": null,
@@ -9646,7 +9646,7 @@
9646
9646
  "name": "EndpointUser",
9647
9647
  "non_null": false
9648
9648
  },
9649
- "varName": "EndpointUser"
9649
+ "varName": "endpointUser"
9650
9650
  }
9651
9651
  },
9652
9652
  "inputFields": null,
@@ -9667,10 +9667,10 @@
9667
9667
  "name": "CatoResource",
9668
9668
  "non_null": false
9669
9669
  },
9670
- "varName": "CatoResource"
9670
+ "varName": "catoResource"
9671
9671
  },
9672
9672
  "status": {
9673
- "alias": "RemediationStatusEnumStatus: status",
9673
+ "alias": "remediationStatusEnumStatus: status",
9674
9674
  "args": {},
9675
9675
  "deprecationReason": null,
9676
9676
  "description": "Enum for the remediation status of the EPP alert",
@@ -9879,10 +9879,10 @@
9879
9879
  "name": "CatoEndpointAlert",
9880
9880
  "non_null": false
9881
9881
  },
9882
- "varName": "CatoEndpointAlert"
9882
+ "varName": "catoEndpointAlert"
9883
9883
  },
9884
9884
  "analystFeedback": {
9885
- "alias": "AnalystFeedback: analystFeedback",
9885
+ "alias": "analystFeedback: analystFeedback",
9886
9886
  "args": {},
9887
9887
  "deprecationReason": null,
9888
9888
  "description": "Fields related to analysts research of the threat incident",
@@ -9890,9 +9890,9 @@
9890
9890
  "isDeprecated": false,
9891
9891
  "name": "analystFeedback",
9892
9892
  "path": "story.incident.CatoEndpoint.analystFeedback",
9893
- "requestStr": "$AnalystFeedback:AnalystFeedback ",
9893
+ "requestStr": "$analystFeedback:AnalystFeedback ",
9894
9894
  "required": false,
9895
- "responseStr": "analystFeedback:$AnalystFeedback ",
9895
+ "responseStr": "analystFeedback:$analystFeedback ",
9896
9896
  "type": {
9897
9897
  "definition": {
9898
9898
  "description": null,
@@ -9996,9 +9996,9 @@
9996
9996
  "isDeprecated": false,
9997
9997
  "name": "threatType",
9998
9998
  "path": "story.incident.CatoEndpoint.analystFeedback.threatType",
9999
- "requestStr": "$AnalystFeedbackThreatType:AnalystFeedbackThreatType ",
9999
+ "requestStr": "$analystFeedbackThreatType:AnalystFeedbackThreatType ",
10000
10000
  "required": false,
10001
- "responseStr": "threatType:$AnalystFeedbackThreatType ",
10001
+ "responseStr": "threatType:$analystFeedbackThreatType ",
10002
10002
  "type": {
10003
10003
  "definition": {
10004
10004
  "description": null,
@@ -10078,7 +10078,7 @@
10078
10078
  "name": "AnalystFeedbackThreatType",
10079
10079
  "non_null": false
10080
10080
  },
10081
- "varName": "AnalystFeedbackThreatType"
10081
+ "varName": "analystFeedbackThreatType"
10082
10082
  },
10083
10083
  "verdict": {
10084
10084
  "args": {},
@@ -10150,10 +10150,10 @@
10150
10150
  "name": "AnalystFeedback",
10151
10151
  "non_null": false
10152
10152
  },
10153
- "varName": "AnalystFeedback"
10153
+ "varName": "analystFeedback"
10154
10154
  },
10155
10155
  "connectionType": {
10156
- "alias": "CatoEndpointConnectionType: connectionType",
10156
+ "alias": "catoEndpointConnectionType: connectionType",
10157
10157
  "args": {},
10158
10158
  "deprecationReason": null,
10159
10159
  "description": "enum for the connection for this incident (ie. host, user)",
@@ -10204,7 +10204,7 @@
10204
10204
  "varName": "connectionType"
10205
10205
  },
10206
10206
  "criticality": {
10207
- "alias": "CatoEndpointCriticality: criticality",
10207
+ "alias": "catoEndpointCriticality: criticality",
10208
10208
  "args": {},
10209
10209
  "deprecationReason": null,
10210
10210
  "description": "Cato's risk analysis of the story. Values are from 1 (low risk) to 10 (high risk)",
@@ -10225,7 +10225,7 @@
10225
10225
  "varName": "criticality"
10226
10226
  },
10227
10227
  "description": {
10228
- "alias": "CatoEndpointDescription: description",
10228
+ "alias": "catoEndpointDescription: description",
10229
10229
  "args": {},
10230
10230
  "deprecationReason": null,
10231
10231
  "description": "Description of the threat",
@@ -10253,9 +10253,9 @@
10253
10253
  "isDeprecated": false,
10254
10254
  "name": "device",
10255
10255
  "path": "story.incident.CatoEndpoint.device",
10256
- "requestStr": "$CatoEndpointDeviceDetails:CatoEndpointDeviceDetails ",
10256
+ "requestStr": "$catoEndpointDeviceDetails:CatoEndpointDeviceDetails ",
10257
10257
  "required": false,
10258
- "responseStr": "device:$CatoEndpointDeviceDetails ",
10258
+ "responseStr": "device:$catoEndpointDeviceDetails ",
10259
10259
  "type": {
10260
10260
  "definition": {
10261
10261
  "description": null,
@@ -10310,9 +10310,9 @@
10310
10310
  "isDeprecated": false,
10311
10311
  "name": "loggedOnUsers",
10312
10312
  "path": "story.incident.CatoEndpoint.device.loggedOnUsers",
10313
- "requestStr": "$EndpointUser:[EndpointUser]! ",
10313
+ "requestStr": "$endpointUser:[EndpointUser]! ",
10314
10314
  "required": true,
10315
- "responseStr": "loggedOnUsers:$EndpointUser ",
10315
+ "responseStr": "loggedOnUsers:$endpointUser ",
10316
10316
  "type": {
10317
10317
  "definition": {
10318
10318
  "description": null,
@@ -10371,7 +10371,7 @@
10371
10371
  "enumValues": null,
10372
10372
  "fields": {
10373
10373
  "id": {
10374
- "alias": "CatoEndpointUserId: id",
10374
+ "alias": "catoEndpointUserId: id",
10375
10375
  "args": {},
10376
10376
  "deprecationReason": null,
10377
10377
  "description": "ID for the user",
@@ -10393,7 +10393,7 @@
10393
10393
  "varName": "id"
10394
10394
  },
10395
10395
  "name": {
10396
- "alias": "CatoEndpointUserName: name",
10396
+ "alias": "catoEndpointUserName: name",
10397
10397
  "args": {},
10398
10398
  "deprecationReason": null,
10399
10399
  "description": "Username for the user whose activity generated the indication",
@@ -10466,7 +10466,7 @@
10466
10466
  "varName": "domainName"
10467
10467
  },
10468
10468
  "id": {
10469
- "alias": "MicrosoftEndpointUserId: id",
10469
+ "alias": "microsoftEndpointUserId: id",
10470
10470
  "args": {},
10471
10471
  "deprecationReason": null,
10472
10472
  "description": null,
@@ -10488,7 +10488,7 @@
10488
10488
  "varName": "id"
10489
10489
  },
10490
10490
  "name": {
10491
- "alias": "MicrosoftEndpointUserName: name",
10491
+ "alias": "microsoftEndpointUserName: name",
10492
10492
  "args": {},
10493
10493
  "deprecationReason": null,
10494
10494
  "description": null,
@@ -10568,7 +10568,7 @@
10568
10568
  "name": "EndpointUser",
10569
10569
  "non_null": false
10570
10570
  },
10571
- "varName": "EndpointUser"
10571
+ "varName": "endpointUser"
10572
10572
  },
10573
10573
  "macAddress": {
10574
10574
  "args": {},
@@ -10598,9 +10598,9 @@
10598
10598
  "isDeprecated": false,
10599
10599
  "name": "osDetails",
10600
10600
  "path": "story.incident.CatoEndpoint.device.osDetails",
10601
- "requestStr": "$OsDetails:OsDetails ",
10601
+ "requestStr": "$osDetails:OsDetails ",
10602
10602
  "required": false,
10603
- "responseStr": "osDetails:$OsDetails ",
10603
+ "responseStr": "osDetails:$osDetails ",
10604
10604
  "type": {
10605
10605
  "definition": {
10606
10606
  "description": null,
@@ -10681,7 +10681,7 @@
10681
10681
  "name": "OsDetails",
10682
10682
  "non_null": false
10683
10683
  },
10684
- "varName": "OsDetails"
10684
+ "varName": "osDetails"
10685
10685
  }
10686
10686
  },
10687
10687
  "inputFields": null,
@@ -10697,10 +10697,10 @@
10697
10697
  "name": "CatoEndpointDeviceDetails",
10698
10698
  "non_null": false
10699
10699
  },
10700
- "varName": "CatoEndpointDeviceDetails"
10700
+ "varName": "catoEndpointDeviceDetails"
10701
10701
  },
10702
10702
  "engineType": {
10703
- "alias": "CatoEndpointEngineType: engineType",
10703
+ "alias": "catoEndpointEngineType: engineType",
10704
10704
  "args": {},
10705
10705
  "deprecationReason": null,
10706
10706
  "description": "enum that shows XDR engine involved with the incident",
@@ -10763,7 +10763,7 @@
10763
10763
  "varName": "engineType"
10764
10764
  },
10765
10765
  "firstSignal": {
10766
- "alias": "CatoEndpointFirstSignal: firstSignal",
10766
+ "alias": "catoEndpointFirstSignal: firstSignal",
10767
10767
  "args": {},
10768
10768
  "deprecationReason": null,
10769
10769
  "description": "Timestamp for the first incident signal related to this story",
@@ -10785,7 +10785,7 @@
10785
10785
  "varName": "firstSignal"
10786
10786
  },
10787
10787
  "id": {
10788
- "alias": "CatoEndpointId: id",
10788
+ "alias": "catoEndpointId: id",
10789
10789
  "args": {},
10790
10790
  "deprecationReason": null,
10791
10791
  "description": "ID for the Endpoint Protection story",
@@ -10807,7 +10807,7 @@
10807
10807
  "varName": "id"
10808
10808
  },
10809
10809
  "indication": {
10810
- "alias": "CatoEndpointIndication: indication",
10810
+ "alias": "catoEndpointIndication: indication",
10811
10811
  "args": {},
10812
10812
  "deprecationReason": null,
10813
10813
  "description": "An indication is a set of actions and behaviors for the Network or Security incident. Each producer has different indications.",
@@ -10829,7 +10829,7 @@
10829
10829
  "varName": "indication"
10830
10830
  },
10831
10831
  "lastSignal": {
10832
- "alias": "CatoEndpointLastSignal: lastSignal",
10832
+ "alias": "catoEndpointLastSignal: lastSignal",
10833
10833
  "args": {},
10834
10834
  "deprecationReason": null,
10835
10835
  "description": "Timestamp for the last (most recent) incident signal related to this story",
@@ -10851,7 +10851,7 @@
10851
10851
  "varName": "lastSignal"
10852
10852
  },
10853
10853
  "predictedThreatType": {
10854
- "alias": "CatoEndpointPredictedThreatType: predictedThreatType",
10854
+ "alias": "catoEndpointPredictedThreatType: predictedThreatType",
10855
10855
  "args": {},
10856
10856
  "deprecationReason": null,
10857
10857
  "description": null,
@@ -10872,7 +10872,7 @@
10872
10872
  "varName": "predictedThreatType"
10873
10873
  },
10874
10874
  "predictedVerdict": {
10875
- "alias": "CatoEndpointPredictedVerdict: predictedVerdict",
10875
+ "alias": "catoEndpointPredictedVerdict: predictedVerdict",
10876
10876
  "args": {},
10877
10877
  "deprecationReason": null,
10878
10878
  "description": null,
@@ -10929,7 +10929,7 @@
10929
10929
  "varName": "predictedVerdict"
10930
10930
  },
10931
10931
  "producer": {
10932
- "alias": "CatoEndpointProducer: producer",
10932
+ "alias": "catoEndpointProducer: producer",
10933
10933
  "args": {},
10934
10934
  "deprecationReason": null,
10935
10935
  "description": "enum for the Producer (specific XDR engine or service) involved with the incident",
@@ -11017,7 +11017,7 @@
11017
11017
  "varName": "producer"
11018
11018
  },
11019
11019
  "producerName": {
11020
- "alias": "CatoEndpointProducerName: producerName",
11020
+ "alias": "catoEndpointProducerName: producerName",
11021
11021
  "args": {},
11022
11022
  "deprecationReason": null,
11023
11023
  "description": "Full name of the Producer (specific XDR engine and service) involved with the incident",
@@ -11039,7 +11039,7 @@
11039
11039
  "varName": "producerName"
11040
11040
  },
11041
11041
  "queryName": {
11042
- "alias": "CatoEndpointQueryName: queryName",
11042
+ "alias": "catoEndpointQueryName: queryName",
11043
11043
  "args": {},
11044
11044
  "deprecationReason": null,
11045
11045
  "description": "",
@@ -11060,7 +11060,7 @@
11060
11060
  "varName": "queryName"
11061
11061
  },
11062
11062
  "research": {
11063
- "alias": "CatoEndpointResearch: research",
11063
+ "alias": "catoEndpointResearch: research",
11064
11064
  "args": {},
11065
11065
  "deprecationReason": null,
11066
11066
  "description": "TRUE indicates that the story is currently being researched by Security Analysts",
@@ -11088,9 +11088,9 @@
11088
11088
  "isDeprecated": false,
11089
11089
  "name": "similarStoriesData",
11090
11090
  "path": "story.incident.CatoEndpoint.similarStoriesData",
11091
- "requestStr": "$SimilarStoryData:[SimilarStoryData]! ",
11091
+ "requestStr": "$similarStoryData:[SimilarStoryData]! ",
11092
11092
  "required": true,
11093
- "responseStr": "similarStoriesData:$SimilarStoryData ",
11093
+ "responseStr": "similarStoriesData:$similarStoryData ",
11094
11094
  "type": {
11095
11095
  "definition": {
11096
11096
  "description": null,
@@ -11233,10 +11233,10 @@
11233
11233
  "name": "SimilarStoryData",
11234
11234
  "non_null": false
11235
11235
  },
11236
- "varName": "SimilarStoryData"
11236
+ "varName": "similarStoryData"
11237
11237
  },
11238
11238
  "site": {
11239
- "alias": "SiteRef: site",
11239
+ "alias": "siteRef: site",
11240
11240
  "args": {},
11241
11241
  "deprecationReason": null,
11242
11242
  "description": "Cato ID and name for the site",
@@ -11244,9 +11244,9 @@
11244
11244
  "isDeprecated": false,
11245
11245
  "name": "site",
11246
11246
  "path": "story.incident.CatoEndpoint.site",
11247
- "requestStr": "$SiteRef:SiteRef ",
11247
+ "requestStr": "$siteRef:SiteRef ",
11248
11248
  "required": false,
11249
- "responseStr": "site:$SiteRef ",
11249
+ "responseStr": "site:$siteRef ",
11250
11250
  "type": {
11251
11251
  "definition": {
11252
11252
  "description": null,
@@ -11308,10 +11308,10 @@
11308
11308
  "name": "SiteRef",
11309
11309
  "non_null": false
11310
11310
  },
11311
- "varName": "SiteRef"
11311
+ "varName": "siteRef"
11312
11312
  },
11313
11313
  "siteName": {
11314
- "alias": "CatoEndpointSiteName: siteName",
11314
+ "alias": "catoEndpointSiteName: siteName",
11315
11315
  "args": {},
11316
11316
  "deprecationReason": null,
11317
11317
  "description": "Site name related to the story",
@@ -11332,7 +11332,7 @@
11332
11332
  "varName": "siteName"
11333
11333
  },
11334
11334
  "source": {
11335
- "alias": "CatoEndpointSource: source",
11335
+ "alias": "catoEndpointSource: source",
11336
11336
  "args": {},
11337
11337
  "deprecationReason": null,
11338
11338
  "description": "IP address, name of device, or SDP user on your network involved in the story",
@@ -11353,7 +11353,7 @@
11353
11353
  "varName": "source"
11354
11354
  },
11355
11355
  "sourceIp": {
11356
- "alias": "CatoEndpointSourceIp: sourceIp",
11356
+ "alias": "catoEndpointSourceIp: sourceIp",
11357
11357
  "args": {},
11358
11358
  "deprecationReason": null,
11359
11359
  "description": "Source IP address of the device in your network sending or receiving the flow",
@@ -11374,7 +11374,7 @@
11374
11374
  "varName": "sourceIp"
11375
11375
  },
11376
11376
  "status": {
11377
- "alias": "CatoEndpointStatus: status",
11377
+ "alias": "catoEndpointStatus: status",
11378
11378
  "args": {},
11379
11379
  "deprecationReason": null,
11380
11380
  "description": "Enum for the status of this story (ie. Open, Closed, Monitoring)",
@@ -11443,7 +11443,7 @@
11443
11443
  "varName": "status"
11444
11444
  },
11445
11445
  "storyDuration": {
11446
- "alias": "CatoEndpointStoryDuration: storyDuration",
11446
+ "alias": "catoEndpointStoryDuration: storyDuration",
11447
11447
  "args": {},
11448
11448
  "deprecationReason": null,
11449
11449
  "description": "Amount of time since the story was opened (no value for closed stories)",
@@ -11464,7 +11464,7 @@
11464
11464
  "varName": "storyDuration"
11465
11465
  },
11466
11466
  "ticket": {
11467
- "alias": "CatoEndpointTicket: ticket",
11467
+ "alias": "catoEndpointTicket: ticket",
11468
11468
  "args": {},
11469
11469
  "deprecationReason": null,
11470
11470
  "description": "The ticket for this story",
@@ -11485,7 +11485,7 @@
11485
11485
  "varName": "ticket"
11486
11486
  },
11487
11487
  "user": {
11488
- "alias": "UserRef: user",
11488
+ "alias": "userRef: user",
11489
11489
  "args": {},
11490
11490
  "deprecationReason": null,
11491
11491
  "description": "Cato ID and name for the site",
@@ -11493,9 +11493,9 @@
11493
11493
  "isDeprecated": false,
11494
11494
  "name": "user",
11495
11495
  "path": "story.incident.CatoEndpoint.user",
11496
- "requestStr": "$UserRef:UserRef ",
11496
+ "requestStr": "$userRef:UserRef ",
11497
11497
  "required": false,
11498
- "responseStr": "user:$UserRef ",
11498
+ "responseStr": "user:$userRef ",
11499
11499
  "type": {
11500
11500
  "definition": {
11501
11501
  "description": null,
@@ -11557,10 +11557,10 @@
11557
11557
  "name": "UserRef",
11558
11558
  "non_null": false
11559
11559
  },
11560
- "varName": "UserRef"
11560
+ "varName": "userRef"
11561
11561
  },
11562
11562
  "vendor": {
11563
- "alias": "CatoEndpointVendor: vendor",
11563
+ "alias": "catoEndpointVendor: vendor",
11564
11564
  "args": {},
11565
11565
  "deprecationReason": null,
11566
11566
  "description": "Vendor that identified the incident, such as Cato or Microsoft",
@@ -11623,16 +11623,16 @@
11623
11623
  "isDeprecated": false,
11624
11624
  "name": "alerts",
11625
11625
  "path": "story.incident.MicrosoftEndpoint.alerts",
11626
- "requestStr": "$MicrosoftDefenderEndpointAlert:[MicrosoftDefenderEndpointAlert]! ",
11626
+ "requestStr": "$microsoftDefenderEndpointAlert:[MicrosoftDefenderEndpointAlert]! ",
11627
11627
  "required": true,
11628
- "responseStr": "alerts:$MicrosoftDefenderEndpointAlert ",
11628
+ "responseStr": "alerts:$microsoftDefenderEndpointAlert ",
11629
11629
  "type": {
11630
11630
  "definition": {
11631
11631
  "description": null,
11632
11632
  "enumValues": null,
11633
11633
  "fields": {
11634
11634
  "activities": {
11635
- "alias": "MicrosoftActivityActivities: activities",
11635
+ "alias": "microsoftActivityActivities: activities",
11636
11636
  "args": {},
11637
11637
  "deprecationReason": null,
11638
11638
  "description": null,
@@ -11640,9 +11640,9 @@
11640
11640
  "isDeprecated": false,
11641
11641
  "name": "activities",
11642
11642
  "path": "story.incident.MicrosoftEndpoint.alerts.activities",
11643
- "requestStr": "$MicrosoftActivity:[MicrosoftActivity]! ",
11643
+ "requestStr": "$microsoftActivity:[MicrosoftActivity]! ",
11644
11644
  "required": true,
11645
- "responseStr": "activities:$MicrosoftActivity ",
11645
+ "responseStr": "activities:$microsoftActivity ",
11646
11646
  "type": {
11647
11647
  "definition": {
11648
11648
  "description": null,
@@ -11788,7 +11788,7 @@
11788
11788
  "name": "MicrosoftActivity",
11789
11789
  "non_null": false
11790
11790
  },
11791
- "varName": "MicrosoftActivity"
11791
+ "varName": "microsoftActivity"
11792
11792
  },
11793
11793
  "alertWebUrl": {
11794
11794
  "args": {},
@@ -11831,7 +11831,7 @@
11831
11831
  "varName": "category"
11832
11832
  },
11833
11833
  "classification": {
11834
- "alias": "AlertClassificationEnumClassification: classification",
11834
+ "alias": "alertClassificationEnumClassification: classification",
11835
11835
  "args": {},
11836
11836
  "deprecationReason": null,
11837
11837
  "description": null,
@@ -12005,7 +12005,7 @@
12005
12005
  "varName": "destinationUrl"
12006
12006
  },
12007
12007
  "detectionSource": {
12008
- "alias": "DetectionSourceEnumDetectionSource: detectionSource",
12008
+ "alias": "detectionSourceEnumDetectionSource: detectionSource",
12009
12009
  "args": {},
12010
12010
  "deprecationReason": null,
12011
12011
  "description": null,
@@ -12134,7 +12134,7 @@
12134
12134
  "varName": "detectionSource"
12135
12135
  },
12136
12136
  "determination": {
12137
- "alias": "AlertDeterminationEnumDetermination: determination",
12137
+ "alias": "alertDeterminationEnumDetermination: determination",
12138
12138
  "args": {},
12139
12139
  "deprecationReason": null,
12140
12140
  "description": null,
@@ -12352,7 +12352,7 @@
12352
12352
  "varName": "localIp"
12353
12353
  },
12354
12354
  "mitreSubTechnique": {
12355
- "alias": "MitreMitreSubTechnique: mitreSubTechnique",
12355
+ "alias": "mitreMitreSubTechnique: mitreSubTechnique",
12356
12356
  "args": {},
12357
12357
  "deprecationReason": null,
12358
12358
  "description": null,
@@ -12360,9 +12360,9 @@
12360
12360
  "isDeprecated": false,
12361
12361
  "name": "mitreSubTechnique",
12362
12362
  "path": "story.incident.MicrosoftEndpoint.alerts.mitreSubTechnique",
12363
- "requestStr": "$Mitre:[Mitre]! ",
12363
+ "requestStr": "$mitre:[Mitre]! ",
12364
12364
  "required": true,
12365
- "responseStr": "mitreSubTechnique:$Mitre ",
12365
+ "responseStr": "mitreSubTechnique:$mitre ",
12366
12366
  "type": {
12367
12367
  "definition": {
12368
12368
  "description": null,
@@ -12425,10 +12425,10 @@
12425
12425
  "name": "Mitre",
12426
12426
  "non_null": false
12427
12427
  },
12428
- "varName": "Mitre"
12428
+ "varName": "mitre"
12429
12429
  },
12430
12430
  "mitreTechnique": {
12431
- "alias": "MitreMitreTechnique: mitreTechnique",
12431
+ "alias": "mitreMitreTechnique: mitreTechnique",
12432
12432
  "args": {},
12433
12433
  "deprecationReason": null,
12434
12434
  "description": null,
@@ -12436,9 +12436,9 @@
12436
12436
  "isDeprecated": false,
12437
12437
  "name": "mitreTechnique",
12438
12438
  "path": "story.incident.MicrosoftEndpoint.alerts.mitreTechnique",
12439
- "requestStr": "$Mitre:[Mitre]! ",
12439
+ "requestStr": "$mitre:[Mitre]! ",
12440
12440
  "required": true,
12441
- "responseStr": "mitreTechnique:$Mitre ",
12441
+ "responseStr": "mitreTechnique:$mitre ",
12442
12442
  "type": {
12443
12443
  "definition": {
12444
12444
  "description": null,
@@ -12501,7 +12501,7 @@
12501
12501
  "name": "Mitre",
12502
12502
  "non_null": false
12503
12503
  },
12504
- "varName": "Mitre"
12504
+ "varName": "mitre"
12505
12505
  },
12506
12506
  "ownerName": {
12507
12507
  "args": {},
@@ -12584,7 +12584,7 @@
12584
12584
  "varName": "resolvedDateTime"
12585
12585
  },
12586
12586
  "resources": {
12587
- "alias": "MicrosoftEndpointResourceResources: resources",
12587
+ "alias": "microsoftEndpointResourceResources: resources",
12588
12588
  "args": {},
12589
12589
  "deprecationReason": null,
12590
12590
  "description": null,
@@ -12592,9 +12592,9 @@
12592
12592
  "isDeprecated": false,
12593
12593
  "name": "resources",
12594
12594
  "path": "story.incident.MicrosoftEndpoint.alerts.resources",
12595
- "requestStr": "$MicrosoftEndpointResource:[MicrosoftEndpointResource]! ",
12595
+ "requestStr": "$microsoftEndpointResource:[MicrosoftEndpointResource]! ",
12596
12596
  "required": true,
12597
- "responseStr": "resources:$MicrosoftEndpointResource ",
12597
+ "responseStr": "resources:$microsoftEndpointResource ",
12598
12598
  "type": {
12599
12599
  "definition": {
12600
12600
  "description": null,
@@ -12642,7 +12642,7 @@
12642
12642
  "varName": "id"
12643
12643
  },
12644
12644
  "remediationStatus": {
12645
- "alias": "RemediationStatusEnumRemediationStatus: remediationStatus",
12645
+ "alias": "remediationStatusEnumRemediationStatus: remediationStatus",
12646
12646
  "args": {},
12647
12647
  "deprecationReason": null,
12648
12648
  "description": null,
@@ -12815,7 +12815,7 @@
12815
12815
  "varName": "remediationStatusDetails"
12816
12816
  },
12817
12817
  "roles": {
12818
- "alias": "ResourceRoleEnumRoles: roles",
12818
+ "alias": "resourceRoleEnumRoles: roles",
12819
12819
  "args": {},
12820
12820
  "deprecationReason": null,
12821
12821
  "description": null,
@@ -12958,7 +12958,7 @@
12958
12958
  "varName": "tags"
12959
12959
  },
12960
12960
  "verdict": {
12961
- "alias": "MsResourceVerdictEnumVerdict: verdict",
12961
+ "alias": "msResourceVerdictEnumVerdict: verdict",
12962
12962
  "args": {},
12963
12963
  "deprecationReason": null,
12964
12964
  "description": null,
@@ -13025,7 +13025,7 @@
13025
13025
  "enumValues": null,
13026
13026
  "fields": {
13027
13027
  "createdDateTime": {
13028
- "alias": "MicrosoftFileResourceCreatedDateTime: createdDateTime",
13028
+ "alias": "microsoftFileResourceCreatedDateTime: createdDateTime",
13029
13029
  "args": {},
13030
13030
  "deprecationReason": null,
13031
13031
  "description": null,
@@ -13103,9 +13103,9 @@
13103
13103
  "isDeprecated": false,
13104
13104
  "name": "fileDetails",
13105
13105
  "path": "story.incident.MicrosoftEndpoint.alerts.resources.MicrosoftFileResource.fileDetails",
13106
- "requestStr": "$FileDetails:FileDetails ",
13106
+ "requestStr": "$fileDetails:FileDetails ",
13107
13107
  "required": false,
13108
- "responseStr": "fileDetails:$FileDetails ",
13108
+ "responseStr": "fileDetails:$fileDetails ",
13109
13109
  "type": {
13110
13110
  "definition": {
13111
13111
  "description": null,
@@ -13305,10 +13305,10 @@
13305
13305
  "name": "FileDetails",
13306
13306
  "non_null": false
13307
13307
  },
13308
- "varName": "FileDetails"
13308
+ "varName": "fileDetails"
13309
13309
  },
13310
13310
  "id": {
13311
- "alias": "MicrosoftFileResourceId: id",
13311
+ "alias": "microsoftFileResourceId: id",
13312
13312
  "args": {},
13313
13313
  "deprecationReason": null,
13314
13314
  "description": null,
@@ -13330,7 +13330,7 @@
13330
13330
  "varName": "id"
13331
13331
  },
13332
13332
  "remediationStatus": {
13333
- "alias": "MicrosoftFileResourceRemediationStatus: remediationStatus",
13333
+ "alias": "microsoftFileResourceRemediationStatus: remediationStatus",
13334
13334
  "args": {},
13335
13335
  "deprecationReason": null,
13336
13336
  "description": null,
@@ -13483,7 +13483,7 @@
13483
13483
  "varName": "remediationStatus"
13484
13484
  },
13485
13485
  "remediationStatusDetails": {
13486
- "alias": "MicrosoftFileResourceRemediationStatusDetails: remediationStatusDetails",
13486
+ "alias": "microsoftFileResourceRemediationStatusDetails: remediationStatusDetails",
13487
13487
  "args": {},
13488
13488
  "deprecationReason": null,
13489
13489
  "description": null,
@@ -13504,7 +13504,7 @@
13504
13504
  "varName": "remediationStatusDetails"
13505
13505
  },
13506
13506
  "roles": {
13507
- "alias": "MicrosoftFileResourceRoles: roles",
13507
+ "alias": "microsoftFileResourceRoles: roles",
13508
13508
  "args": {},
13509
13509
  "deprecationReason": null,
13510
13510
  "description": null,
@@ -13624,7 +13624,7 @@
13624
13624
  "varName": "roles"
13625
13625
  },
13626
13626
  "tags": {
13627
- "alias": "MicrosoftFileResourceTags: tags",
13627
+ "alias": "microsoftFileResourceTags: tags",
13628
13628
  "args": {},
13629
13629
  "deprecationReason": null,
13630
13630
  "description": null,
@@ -13648,7 +13648,7 @@
13648
13648
  "varName": "tags"
13649
13649
  },
13650
13650
  "verdict": {
13651
- "alias": "MicrosoftFileResourceVerdict: verdict",
13651
+ "alias": "microsoftFileResourceVerdict: verdict",
13652
13652
  "args": {},
13653
13653
  "deprecationReason": null,
13654
13654
  "description": null,
@@ -13716,7 +13716,7 @@
13716
13716
  "enumValues": null,
13717
13717
  "fields": {
13718
13718
  "createdDateTime": {
13719
- "alias": "MicrosoftProcessResourceCreatedDateTime: createdDateTime",
13719
+ "alias": "microsoftProcessResourceCreatedDateTime: createdDateTime",
13720
13720
  "args": {},
13721
13721
  "deprecationReason": null,
13722
13722
  "description": null,
@@ -13737,7 +13737,7 @@
13737
13737
  "varName": "createdDateTime"
13738
13738
  },
13739
13739
  "id": {
13740
- "alias": "MicrosoftProcessResourceId: id",
13740
+ "alias": "microsoftProcessResourceId: id",
13741
13741
  "args": {},
13742
13742
  "deprecationReason": null,
13743
13743
  "description": null,
@@ -13766,9 +13766,9 @@
13766
13766
  "isDeprecated": false,
13767
13767
  "name": "imageFile",
13768
13768
  "path": "story.incident.MicrosoftEndpoint.alerts.resources.MicrosoftProcessResource.imageFile",
13769
- "requestStr": "$FileDetails:FileDetails ",
13769
+ "requestStr": "$fileDetails:FileDetails ",
13770
13770
  "required": false,
13771
- "responseStr": "imageFile:$FileDetails ",
13771
+ "responseStr": "imageFile:$fileDetails ",
13772
13772
  "type": {
13773
13773
  "definition": {
13774
13774
  "description": null,
@@ -13968,7 +13968,7 @@
13968
13968
  "name": "FileDetails",
13969
13969
  "non_null": false
13970
13970
  },
13971
- "varName": "FileDetails"
13971
+ "varName": "fileDetails"
13972
13972
  },
13973
13973
  "processCommandLine": {
13974
13974
  "args": {},
@@ -14012,7 +14012,7 @@
14012
14012
  "varName": "processId"
14013
14013
  },
14014
14014
  "remediationStatus": {
14015
- "alias": "MicrosoftProcessResourceRemediationStatus: remediationStatus",
14015
+ "alias": "microsoftProcessResourceRemediationStatus: remediationStatus",
14016
14016
  "args": {},
14017
14017
  "deprecationReason": null,
14018
14018
  "description": null,
@@ -14165,7 +14165,7 @@
14165
14165
  "varName": "remediationStatus"
14166
14166
  },
14167
14167
  "remediationStatusDetails": {
14168
- "alias": "MicrosoftProcessResourceRemediationStatusDetails: remediationStatusDetails",
14168
+ "alias": "microsoftProcessResourceRemediationStatusDetails: remediationStatusDetails",
14169
14169
  "args": {},
14170
14170
  "deprecationReason": null,
14171
14171
  "description": null,
@@ -14186,7 +14186,7 @@
14186
14186
  "varName": "remediationStatusDetails"
14187
14187
  },
14188
14188
  "roles": {
14189
- "alias": "MicrosoftProcessResourceRoles: roles",
14189
+ "alias": "microsoftProcessResourceRoles: roles",
14190
14190
  "args": {},
14191
14191
  "deprecationReason": null,
14192
14192
  "description": null,
@@ -14306,7 +14306,7 @@
14306
14306
  "varName": "roles"
14307
14307
  },
14308
14308
  "tags": {
14309
- "alias": "MicrosoftProcessResourceTags: tags",
14309
+ "alias": "microsoftProcessResourceTags: tags",
14310
14310
  "args": {},
14311
14311
  "deprecationReason": null,
14312
14312
  "description": null,
@@ -14337,9 +14337,9 @@
14337
14337
  "isDeprecated": false,
14338
14338
  "name": "userAccount",
14339
14339
  "path": "story.incident.MicrosoftEndpoint.alerts.resources.MicrosoftProcessResource.userAccount",
14340
- "requestStr": "$EndpointUser:EndpointUser ",
14340
+ "requestStr": "$endpointUser:EndpointUser ",
14341
14341
  "required": false,
14342
- "responseStr": "userAccount:$EndpointUser ",
14342
+ "responseStr": "userAccount:$endpointUser ",
14343
14343
  "type": {
14344
14344
  "definition": {
14345
14345
  "description": null,
@@ -14398,7 +14398,7 @@
14398
14398
  "enumValues": null,
14399
14399
  "fields": {
14400
14400
  "id": {
14401
- "alias": "CatoEndpointUserId: id",
14401
+ "alias": "catoEndpointUserId: id",
14402
14402
  "args": {},
14403
14403
  "deprecationReason": null,
14404
14404
  "description": "ID for the user",
@@ -14420,7 +14420,7 @@
14420
14420
  "varName": "id"
14421
14421
  },
14422
14422
  "name": {
14423
- "alias": "CatoEndpointUserName: name",
14423
+ "alias": "catoEndpointUserName: name",
14424
14424
  "args": {},
14425
14425
  "deprecationReason": null,
14426
14426
  "description": "Username for the user whose activity generated the indication",
@@ -14493,7 +14493,7 @@
14493
14493
  "varName": "domainName"
14494
14494
  },
14495
14495
  "id": {
14496
- "alias": "MicrosoftEndpointUserId: id",
14496
+ "alias": "microsoftEndpointUserId: id",
14497
14497
  "args": {},
14498
14498
  "deprecationReason": null,
14499
14499
  "description": null,
@@ -14515,7 +14515,7 @@
14515
14515
  "varName": "id"
14516
14516
  },
14517
14517
  "name": {
14518
- "alias": "MicrosoftEndpointUserName: name",
14518
+ "alias": "microsoftEndpointUserName: name",
14519
14519
  "args": {},
14520
14520
  "deprecationReason": null,
14521
14521
  "description": null,
@@ -14592,10 +14592,10 @@
14592
14592
  "name": "EndpointUser",
14593
14593
  "non_null": false
14594
14594
  },
14595
- "varName": "EndpointUser"
14595
+ "varName": "endpointUser"
14596
14596
  },
14597
14597
  "verdict": {
14598
- "alias": "MicrosoftProcessResourceVerdict: verdict",
14598
+ "alias": "microsoftProcessResourceVerdict: verdict",
14599
14599
  "args": {},
14600
14600
  "deprecationReason": null,
14601
14601
  "description": null,
@@ -14663,7 +14663,7 @@
14663
14663
  "enumValues": null,
14664
14664
  "fields": {
14665
14665
  "createdDateTime": {
14666
- "alias": "MicrosoftRegistryResourceCreatedDateTime: createdDateTime",
14666
+ "alias": "microsoftRegistryResourceCreatedDateTime: createdDateTime",
14667
14667
  "args": {},
14668
14668
  "deprecationReason": null,
14669
14669
  "description": null,
@@ -14704,7 +14704,7 @@
14704
14704
  "varName": "hive"
14705
14705
  },
14706
14706
  "id": {
14707
- "alias": "MicrosoftRegistryResourceId: id",
14707
+ "alias": "microsoftRegistryResourceId: id",
14708
14708
  "args": {},
14709
14709
  "deprecationReason": null,
14710
14710
  "description": null,
@@ -14746,7 +14746,7 @@
14746
14746
  "varName": "key"
14747
14747
  },
14748
14748
  "remediationStatus": {
14749
- "alias": "MicrosoftRegistryResourceRemediationStatus: remediationStatus",
14749
+ "alias": "microsoftRegistryResourceRemediationStatus: remediationStatus",
14750
14750
  "args": {},
14751
14751
  "deprecationReason": null,
14752
14752
  "description": null,
@@ -14899,7 +14899,7 @@
14899
14899
  "varName": "remediationStatus"
14900
14900
  },
14901
14901
  "remediationStatusDetails": {
14902
- "alias": "MicrosoftRegistryResourceRemediationStatusDetails: remediationStatusDetails",
14902
+ "alias": "microsoftRegistryResourceRemediationStatusDetails: remediationStatusDetails",
14903
14903
  "args": {},
14904
14904
  "deprecationReason": null,
14905
14905
  "description": null,
@@ -14920,7 +14920,7 @@
14920
14920
  "varName": "remediationStatusDetails"
14921
14921
  },
14922
14922
  "roles": {
14923
- "alias": "MicrosoftRegistryResourceRoles: roles",
14923
+ "alias": "microsoftRegistryResourceRoles: roles",
14924
14924
  "args": {},
14925
14925
  "deprecationReason": null,
14926
14926
  "description": null,
@@ -15040,7 +15040,7 @@
15040
15040
  "varName": "roles"
15041
15041
  },
15042
15042
  "tags": {
15043
- "alias": "MicrosoftRegistryResourceTags: tags",
15043
+ "alias": "microsoftRegistryResourceTags: tags",
15044
15044
  "args": {},
15045
15045
  "deprecationReason": null,
15046
15046
  "description": null,
@@ -15124,7 +15124,7 @@
15124
15124
  "varName": "valueType"
15125
15125
  },
15126
15126
  "verdict": {
15127
- "alias": "MicrosoftRegistryResourceVerdict: verdict",
15127
+ "alias": "microsoftRegistryResourceVerdict: verdict",
15128
15128
  "args": {},
15129
15129
  "deprecationReason": null,
15130
15130
  "description": null,
@@ -15199,10 +15199,10 @@
15199
15199
  "name": "MicrosoftEndpointResource",
15200
15200
  "non_null": false
15201
15201
  },
15202
- "varName": "MicrosoftEndpointResource"
15202
+ "varName": "microsoftEndpointResource"
15203
15203
  },
15204
15204
  "status": {
15205
- "alias": "MsAlertStatusStatus: status",
15205
+ "alias": "msAlertStatusStatus: status",
15206
15206
  "args": {},
15207
15207
  "deprecationReason": null,
15208
15208
  "description": null,
@@ -15349,10 +15349,10 @@
15349
15349
  "name": "MicrosoftDefenderEndpointAlert",
15350
15350
  "non_null": false
15351
15351
  },
15352
- "varName": "MicrosoftDefenderEndpointAlert"
15352
+ "varName": "microsoftDefenderEndpointAlert"
15353
15353
  },
15354
15354
  "analystFeedback": {
15355
- "alias": "AnalystFeedback: analystFeedback",
15355
+ "alias": "analystFeedback: analystFeedback",
15356
15356
  "args": {},
15357
15357
  "deprecationReason": null,
15358
15358
  "description": null,
@@ -15360,9 +15360,9 @@
15360
15360
  "isDeprecated": false,
15361
15361
  "name": "analystFeedback",
15362
15362
  "path": "story.incident.MicrosoftEndpoint.analystFeedback",
15363
- "requestStr": "$AnalystFeedback:AnalystFeedback ",
15363
+ "requestStr": "$analystFeedback:AnalystFeedback ",
15364
15364
  "required": false,
15365
- "responseStr": "analystFeedback:$AnalystFeedback ",
15365
+ "responseStr": "analystFeedback:$analystFeedback ",
15366
15366
  "type": {
15367
15367
  "definition": {
15368
15368
  "description": null,
@@ -15466,9 +15466,9 @@
15466
15466
  "isDeprecated": false,
15467
15467
  "name": "threatType",
15468
15468
  "path": "story.incident.MicrosoftEndpoint.analystFeedback.threatType",
15469
- "requestStr": "$AnalystFeedbackThreatType:AnalystFeedbackThreatType ",
15469
+ "requestStr": "$analystFeedbackThreatType:AnalystFeedbackThreatType ",
15470
15470
  "required": false,
15471
- "responseStr": "threatType:$AnalystFeedbackThreatType ",
15471
+ "responseStr": "threatType:$analystFeedbackThreatType ",
15472
15472
  "type": {
15473
15473
  "definition": {
15474
15474
  "description": null,
@@ -15548,7 +15548,7 @@
15548
15548
  "name": "AnalystFeedbackThreatType",
15549
15549
  "non_null": false
15550
15550
  },
15551
- "varName": "AnalystFeedbackThreatType"
15551
+ "varName": "analystFeedbackThreatType"
15552
15552
  },
15553
15553
  "verdict": {
15554
15554
  "args": {},
@@ -15620,10 +15620,10 @@
15620
15620
  "name": "AnalystFeedback",
15621
15621
  "non_null": false
15622
15622
  },
15623
- "varName": "AnalystFeedback"
15623
+ "varName": "analystFeedback"
15624
15624
  },
15625
15625
  "connectionType": {
15626
- "alias": "MicrosoftEndpointConnectionType: connectionType",
15626
+ "alias": "microsoftEndpointConnectionType: connectionType",
15627
15627
  "args": {},
15628
15628
  "deprecationReason": null,
15629
15629
  "description": null,
@@ -15674,7 +15674,7 @@
15674
15674
  "varName": "connectionType"
15675
15675
  },
15676
15676
  "criticality": {
15677
- "alias": "MicrosoftEndpointCriticality: criticality",
15677
+ "alias": "microsoftEndpointCriticality: criticality",
15678
15678
  "args": {},
15679
15679
  "deprecationReason": null,
15680
15680
  "description": null,
@@ -15695,7 +15695,7 @@
15695
15695
  "varName": "criticality"
15696
15696
  },
15697
15697
  "description": {
15698
- "alias": "MicrosoftEndpointDescription: description",
15698
+ "alias": "microsoftEndpointDescription: description",
15699
15699
  "args": {},
15700
15700
  "deprecationReason": null,
15701
15701
  "description": null,
@@ -15723,9 +15723,9 @@
15723
15723
  "isDeprecated": false,
15724
15724
  "name": "device",
15725
15725
  "path": "story.incident.MicrosoftEndpoint.device",
15726
- "requestStr": "$MicrosoftDeviceDetails:MicrosoftDeviceDetails ",
15726
+ "requestStr": "$microsoftDeviceDetails:MicrosoftDeviceDetails ",
15727
15727
  "required": false,
15728
- "responseStr": "device:$MicrosoftDeviceDetails ",
15728
+ "responseStr": "device:$microsoftDeviceDetails ",
15729
15729
  "type": {
15730
15730
  "definition": {
15731
15731
  "description": null,
@@ -15961,9 +15961,9 @@
15961
15961
  "isDeprecated": false,
15962
15962
  "name": "loggedOnUsers",
15963
15963
  "path": "story.incident.MicrosoftEndpoint.device.loggedOnUsers",
15964
- "requestStr": "$EndpointUser:[EndpointUser]! ",
15964
+ "requestStr": "$endpointUser:[EndpointUser]! ",
15965
15965
  "required": true,
15966
- "responseStr": "loggedOnUsers:$EndpointUser ",
15966
+ "responseStr": "loggedOnUsers:$endpointUser ",
15967
15967
  "type": {
15968
15968
  "definition": {
15969
15969
  "description": null,
@@ -16022,7 +16022,7 @@
16022
16022
  "enumValues": null,
16023
16023
  "fields": {
16024
16024
  "id": {
16025
- "alias": "CatoEndpointUserId: id",
16025
+ "alias": "catoEndpointUserId: id",
16026
16026
  "args": {},
16027
16027
  "deprecationReason": null,
16028
16028
  "description": "ID for the user",
@@ -16044,7 +16044,7 @@
16044
16044
  "varName": "id"
16045
16045
  },
16046
16046
  "name": {
16047
- "alias": "CatoEndpointUserName: name",
16047
+ "alias": "catoEndpointUserName: name",
16048
16048
  "args": {},
16049
16049
  "deprecationReason": null,
16050
16050
  "description": "Username for the user whose activity generated the indication",
@@ -16117,7 +16117,7 @@
16117
16117
  "varName": "domainName"
16118
16118
  },
16119
16119
  "id": {
16120
- "alias": "MicrosoftEndpointUserId: id",
16120
+ "alias": "microsoftEndpointUserId: id",
16121
16121
  "args": {},
16122
16122
  "deprecationReason": null,
16123
16123
  "description": null,
@@ -16139,7 +16139,7 @@
16139
16139
  "varName": "id"
16140
16140
  },
16141
16141
  "name": {
16142
- "alias": "MicrosoftEndpointUserName: name",
16142
+ "alias": "microsoftEndpointUserName: name",
16143
16143
  "args": {},
16144
16144
  "deprecationReason": null,
16145
16145
  "description": null,
@@ -16219,7 +16219,7 @@
16219
16219
  "name": "EndpointUser",
16220
16220
  "non_null": false
16221
16221
  },
16222
- "varName": "EndpointUser"
16222
+ "varName": "endpointUser"
16223
16223
  },
16224
16224
  "onboardingStatus": {
16225
16225
  "args": {},
@@ -16279,9 +16279,9 @@
16279
16279
  "isDeprecated": false,
16280
16280
  "name": "osDetails",
16281
16281
  "path": "story.incident.MicrosoftEndpoint.device.osDetails",
16282
- "requestStr": "$OsDetails:OsDetails ",
16282
+ "requestStr": "$osDetails:OsDetails ",
16283
16283
  "required": false,
16284
- "responseStr": "osDetails:$OsDetails ",
16284
+ "responseStr": "osDetails:$osDetails ",
16285
16285
  "type": {
16286
16286
  "definition": {
16287
16287
  "description": null,
@@ -16362,7 +16362,7 @@
16362
16362
  "name": "OsDetails",
16363
16363
  "non_null": false
16364
16364
  },
16365
- "varName": "OsDetails"
16365
+ "varName": "osDetails"
16366
16366
  },
16367
16367
  "rbacGroup": {
16368
16368
  "args": {},
@@ -16372,9 +16372,9 @@
16372
16372
  "isDeprecated": false,
16373
16373
  "name": "rbacGroup",
16374
16374
  "path": "story.incident.MicrosoftEndpoint.device.rbacGroup",
16375
- "requestStr": "$RbacGroup:RbacGroup ",
16375
+ "requestStr": "$rbacGroup:RbacGroup ",
16376
16376
  "required": false,
16377
- "responseStr": "rbacGroup:$RbacGroup ",
16377
+ "responseStr": "rbacGroup:$rbacGroup ",
16378
16378
  "type": {
16379
16379
  "definition": {
16380
16380
  "description": null,
@@ -16435,7 +16435,7 @@
16435
16435
  "name": "RbacGroup",
16436
16436
  "non_null": false
16437
16437
  },
16438
- "varName": "RbacGroup"
16438
+ "varName": "rbacGroup"
16439
16439
  }
16440
16440
  },
16441
16441
  "inputFields": null,
@@ -16451,10 +16451,10 @@
16451
16451
  "name": "MicrosoftDeviceDetails",
16452
16452
  "non_null": false
16453
16453
  },
16454
- "varName": "MicrosoftDeviceDetails"
16454
+ "varName": "microsoftDeviceDetails"
16455
16455
  },
16456
16456
  "engineType": {
16457
- "alias": "MicrosoftEndpointEngineType: engineType",
16457
+ "alias": "microsoftEndpointEngineType: engineType",
16458
16458
  "args": {},
16459
16459
  "deprecationReason": null,
16460
16460
  "description": null,
@@ -16517,7 +16517,7 @@
16517
16517
  "varName": "engineType"
16518
16518
  },
16519
16519
  "firstSignal": {
16520
- "alias": "MicrosoftEndpointFirstSignal: firstSignal",
16520
+ "alias": "microsoftEndpointFirstSignal: firstSignal",
16521
16521
  "args": {},
16522
16522
  "deprecationReason": null,
16523
16523
  "description": null,
@@ -16539,7 +16539,7 @@
16539
16539
  "varName": "firstSignal"
16540
16540
  },
16541
16541
  "id": {
16542
- "alias": "MicrosoftEndpointId: id",
16542
+ "alias": "microsoftEndpointId: id",
16543
16543
  "args": {},
16544
16544
  "deprecationReason": null,
16545
16545
  "description": null,
@@ -16561,7 +16561,7 @@
16561
16561
  "varName": "id"
16562
16562
  },
16563
16563
  "indication": {
16564
- "alias": "MicrosoftEndpointIndication: indication",
16564
+ "alias": "microsoftEndpointIndication: indication",
16565
16565
  "args": {},
16566
16566
  "deprecationReason": null,
16567
16567
  "description": null,
@@ -16583,7 +16583,7 @@
16583
16583
  "varName": "indication"
16584
16584
  },
16585
16585
  "lastSignal": {
16586
- "alias": "MicrosoftEndpointLastSignal: lastSignal",
16586
+ "alias": "microsoftEndpointLastSignal: lastSignal",
16587
16587
  "args": {},
16588
16588
  "deprecationReason": null,
16589
16589
  "description": null,
@@ -16605,7 +16605,7 @@
16605
16605
  "varName": "lastSignal"
16606
16606
  },
16607
16607
  "predictedThreatType": {
16608
- "alias": "MicrosoftEndpointPredictedThreatType: predictedThreatType",
16608
+ "alias": "microsoftEndpointPredictedThreatType: predictedThreatType",
16609
16609
  "args": {},
16610
16610
  "deprecationReason": null,
16611
16611
  "description": null,
@@ -16626,7 +16626,7 @@
16626
16626
  "varName": "predictedThreatType"
16627
16627
  },
16628
16628
  "predictedVerdict": {
16629
- "alias": "MicrosoftEndpointPredictedVerdict: predictedVerdict",
16629
+ "alias": "microsoftEndpointPredictedVerdict: predictedVerdict",
16630
16630
  "args": {},
16631
16631
  "deprecationReason": null,
16632
16632
  "description": null,
@@ -16683,7 +16683,7 @@
16683
16683
  "varName": "predictedVerdict"
16684
16684
  },
16685
16685
  "producer": {
16686
- "alias": "MicrosoftEndpointProducer: producer",
16686
+ "alias": "microsoftEndpointProducer: producer",
16687
16687
  "args": {},
16688
16688
  "deprecationReason": null,
16689
16689
  "description": null,
@@ -16771,7 +16771,7 @@
16771
16771
  "varName": "producer"
16772
16772
  },
16773
16773
  "producerName": {
16774
- "alias": "MicrosoftEndpointProducerName: producerName",
16774
+ "alias": "microsoftEndpointProducerName: producerName",
16775
16775
  "args": {},
16776
16776
  "deprecationReason": null,
16777
16777
  "description": null,
@@ -16793,7 +16793,7 @@
16793
16793
  "varName": "producerName"
16794
16794
  },
16795
16795
  "queryName": {
16796
- "alias": "MicrosoftEndpointQueryName: queryName",
16796
+ "alias": "microsoftEndpointQueryName: queryName",
16797
16797
  "args": {},
16798
16798
  "deprecationReason": null,
16799
16799
  "description": null,
@@ -16814,7 +16814,7 @@
16814
16814
  "varName": "queryName"
16815
16815
  },
16816
16816
  "research": {
16817
- "alias": "MicrosoftEndpointResearch: research",
16817
+ "alias": "microsoftEndpointResearch: research",
16818
16818
  "args": {},
16819
16819
  "deprecationReason": null,
16820
16820
  "description": null,
@@ -16842,9 +16842,9 @@
16842
16842
  "isDeprecated": false,
16843
16843
  "name": "similarStoriesData",
16844
16844
  "path": "story.incident.MicrosoftEndpoint.similarStoriesData",
16845
- "requestStr": "$SimilarStoryData:[SimilarStoryData]! ",
16845
+ "requestStr": "$similarStoryData:[SimilarStoryData]! ",
16846
16846
  "required": true,
16847
- "responseStr": "similarStoriesData:$SimilarStoryData ",
16847
+ "responseStr": "similarStoriesData:$similarStoryData ",
16848
16848
  "type": {
16849
16849
  "definition": {
16850
16850
  "description": null,
@@ -16987,10 +16987,10 @@
16987
16987
  "name": "SimilarStoryData",
16988
16988
  "non_null": false
16989
16989
  },
16990
- "varName": "SimilarStoryData"
16990
+ "varName": "similarStoryData"
16991
16991
  },
16992
16992
  "site": {
16993
- "alias": "SiteRef: site",
16993
+ "alias": "siteRef: site",
16994
16994
  "args": {},
16995
16995
  "deprecationReason": null,
16996
16996
  "description": null,
@@ -16998,9 +16998,9 @@
16998
16998
  "isDeprecated": false,
16999
16999
  "name": "site",
17000
17000
  "path": "story.incident.MicrosoftEndpoint.site",
17001
- "requestStr": "$SiteRef:SiteRef ",
17001
+ "requestStr": "$siteRef:SiteRef ",
17002
17002
  "required": false,
17003
- "responseStr": "site:$SiteRef ",
17003
+ "responseStr": "site:$siteRef ",
17004
17004
  "type": {
17005
17005
  "definition": {
17006
17006
  "description": null,
@@ -17062,10 +17062,10 @@
17062
17062
  "name": "SiteRef",
17063
17063
  "non_null": false
17064
17064
  },
17065
- "varName": "SiteRef"
17065
+ "varName": "siteRef"
17066
17066
  },
17067
17067
  "siteName": {
17068
- "alias": "MicrosoftEndpointSiteName: siteName",
17068
+ "alias": "microsoftEndpointSiteName: siteName",
17069
17069
  "args": {},
17070
17070
  "deprecationReason": null,
17071
17071
  "description": null,
@@ -17086,7 +17086,7 @@
17086
17086
  "varName": "siteName"
17087
17087
  },
17088
17088
  "source": {
17089
- "alias": "MicrosoftEndpointSource: source",
17089
+ "alias": "microsoftEndpointSource: source",
17090
17090
  "args": {},
17091
17091
  "deprecationReason": null,
17092
17092
  "description": null,
@@ -17107,7 +17107,7 @@
17107
17107
  "varName": "source"
17108
17108
  },
17109
17109
  "sourceIp": {
17110
- "alias": "MicrosoftEndpointSourceIp: sourceIp",
17110
+ "alias": "microsoftEndpointSourceIp: sourceIp",
17111
17111
  "args": {},
17112
17112
  "deprecationReason": null,
17113
17113
  "description": null,
@@ -17128,7 +17128,7 @@
17128
17128
  "varName": "sourceIp"
17129
17129
  },
17130
17130
  "status": {
17131
- "alias": "MicrosoftEndpointStatus: status",
17131
+ "alias": "microsoftEndpointStatus: status",
17132
17132
  "args": {},
17133
17133
  "deprecationReason": null,
17134
17134
  "description": null,
@@ -17197,7 +17197,7 @@
17197
17197
  "varName": "status"
17198
17198
  },
17199
17199
  "storyDuration": {
17200
- "alias": "MicrosoftEndpointStoryDuration: storyDuration",
17200
+ "alias": "microsoftEndpointStoryDuration: storyDuration",
17201
17201
  "args": {},
17202
17202
  "deprecationReason": null,
17203
17203
  "description": null,
@@ -17218,7 +17218,7 @@
17218
17218
  "varName": "storyDuration"
17219
17219
  },
17220
17220
  "ticket": {
17221
- "alias": "MicrosoftEndpointTicket: ticket",
17221
+ "alias": "microsoftEndpointTicket: ticket",
17222
17222
  "args": {},
17223
17223
  "deprecationReason": null,
17224
17224
  "description": null,
@@ -17239,7 +17239,7 @@
17239
17239
  "varName": "ticket"
17240
17240
  },
17241
17241
  "user": {
17242
- "alias": "UserRef: user",
17242
+ "alias": "userRef: user",
17243
17243
  "args": {},
17244
17244
  "deprecationReason": null,
17245
17245
  "description": null,
@@ -17247,9 +17247,9 @@
17247
17247
  "isDeprecated": false,
17248
17248
  "name": "user",
17249
17249
  "path": "story.incident.MicrosoftEndpoint.user",
17250
- "requestStr": "$UserRef:UserRef ",
17250
+ "requestStr": "$userRef:UserRef ",
17251
17251
  "required": false,
17252
- "responseStr": "user:$UserRef ",
17252
+ "responseStr": "user:$userRef ",
17253
17253
  "type": {
17254
17254
  "definition": {
17255
17255
  "description": null,
@@ -17311,10 +17311,10 @@
17311
17311
  "name": "UserRef",
17312
17312
  "non_null": false
17313
17313
  },
17314
- "varName": "UserRef"
17314
+ "varName": "userRef"
17315
17315
  },
17316
17316
  "vendor": {
17317
- "alias": "MicrosoftEndpointVendor: vendor",
17317
+ "alias": "microsoftEndpointVendor: vendor",
17318
17318
  "args": {},
17319
17319
  "deprecationReason": null,
17320
17320
  "description": null,
@@ -17390,7 +17390,7 @@
17390
17390
  "varName": "acknowledged"
17391
17391
  },
17392
17392
  "analystFeedback": {
17393
- "alias": "AnalystFeedback: analystFeedback",
17393
+ "alias": "analystFeedback: analystFeedback",
17394
17394
  "args": {},
17395
17395
  "deprecationReason": null,
17396
17396
  "description": null,
@@ -17398,9 +17398,9 @@
17398
17398
  "isDeprecated": false,
17399
17399
  "name": "analystFeedback",
17400
17400
  "path": "story.incident.NetworkXDRIncident.analystFeedback",
17401
- "requestStr": "$AnalystFeedback:AnalystFeedback ",
17401
+ "requestStr": "$analystFeedback:AnalystFeedback ",
17402
17402
  "required": false,
17403
- "responseStr": "analystFeedback:$AnalystFeedback ",
17403
+ "responseStr": "analystFeedback:$analystFeedback ",
17404
17404
  "type": {
17405
17405
  "definition": {
17406
17406
  "description": null,
@@ -17504,9 +17504,9 @@
17504
17504
  "isDeprecated": false,
17505
17505
  "name": "threatType",
17506
17506
  "path": "story.incident.NetworkXDRIncident.analystFeedback.threatType",
17507
- "requestStr": "$AnalystFeedbackThreatType:AnalystFeedbackThreatType ",
17507
+ "requestStr": "$analystFeedbackThreatType:AnalystFeedbackThreatType ",
17508
17508
  "required": false,
17509
- "responseStr": "threatType:$AnalystFeedbackThreatType ",
17509
+ "responseStr": "threatType:$analystFeedbackThreatType ",
17510
17510
  "type": {
17511
17511
  "definition": {
17512
17512
  "description": null,
@@ -17586,7 +17586,7 @@
17586
17586
  "name": "AnalystFeedbackThreatType",
17587
17587
  "non_null": false
17588
17588
  },
17589
- "varName": "AnalystFeedbackThreatType"
17589
+ "varName": "analystFeedbackThreatType"
17590
17590
  },
17591
17591
  "verdict": {
17592
17592
  "args": {},
@@ -17658,7 +17658,7 @@
17658
17658
  "name": "AnalystFeedback",
17659
17659
  "non_null": false
17660
17660
  },
17661
- "varName": "AnalystFeedback"
17661
+ "varName": "analystFeedback"
17662
17662
  },
17663
17663
  "bgpConnection": {
17664
17664
  "args": {},
@@ -17668,9 +17668,9 @@
17668
17668
  "isDeprecated": false,
17669
17669
  "name": "bgpConnection",
17670
17670
  "path": "story.incident.NetworkXDRIncident.bgpConnection",
17671
- "requestStr": "$BGPConnection:BGPConnection ",
17671
+ "requestStr": "$bGPConnection:BGPConnection ",
17672
17672
  "required": false,
17673
- "responseStr": "bgpConnection:$BGPConnection ",
17673
+ "responseStr": "bgpConnection:$bGPConnection ",
17674
17674
  "type": {
17675
17675
  "definition": {
17676
17676
  "description": null,
@@ -17790,10 +17790,10 @@
17790
17790
  "name": "BGPConnection",
17791
17791
  "non_null": false
17792
17792
  },
17793
- "varName": "BGPConnection"
17793
+ "varName": "bGPConnection"
17794
17794
  },
17795
17795
  "connectionType": {
17796
- "alias": "NetworkXDRIncidentConnectionType: connectionType",
17796
+ "alias": "networkXDRIncidentConnectionType: connectionType",
17797
17797
  "args": {},
17798
17798
  "deprecationReason": null,
17799
17799
  "description": null,
@@ -17844,7 +17844,7 @@
17844
17844
  "varName": "connectionType"
17845
17845
  },
17846
17846
  "criticality": {
17847
- "alias": "NetworkXDRIncidentCriticality: criticality",
17847
+ "alias": "networkXDRIncidentCriticality: criticality",
17848
17848
  "args": {},
17849
17849
  "deprecationReason": null,
17850
17850
  "description": null,
@@ -17865,7 +17865,7 @@
17865
17865
  "varName": "criticality"
17866
17866
  },
17867
17867
  "description": {
17868
- "alias": "NetworkXDRIncidentDescription: description",
17868
+ "alias": "networkXDRIncidentDescription: description",
17869
17869
  "args": {},
17870
17870
  "deprecationReason": null,
17871
17871
  "description": null,
@@ -17930,7 +17930,7 @@
17930
17930
  "varName": "deviceConfigHaRole"
17931
17931
  },
17932
17932
  "engineType": {
17933
- "alias": "NetworkXDRIncidentEngineType: engineType",
17933
+ "alias": "networkXDRIncidentEngineType: engineType",
17934
17934
  "args": {},
17935
17935
  "deprecationReason": null,
17936
17936
  "description": null,
@@ -17993,7 +17993,7 @@
17993
17993
  "varName": "engineType"
17994
17994
  },
17995
17995
  "firstSignal": {
17996
- "alias": "NetworkXDRIncidentFirstSignal: firstSignal",
17996
+ "alias": "networkXDRIncidentFirstSignal: firstSignal",
17997
17997
  "args": {},
17998
17998
  "deprecationReason": null,
17999
17999
  "description": null,
@@ -18035,7 +18035,7 @@
18035
18035
  "varName": "hostIp"
18036
18036
  },
18037
18037
  "id": {
18038
- "alias": "NetworkXDRIncidentId: id",
18038
+ "alias": "networkXDRIncidentId: id",
18039
18039
  "args": {},
18040
18040
  "deprecationReason": null,
18041
18041
  "description": null,
@@ -18064,9 +18064,9 @@
18064
18064
  "isDeprecated": false,
18065
18065
  "name": "ilmmDetails",
18066
18066
  "path": "story.incident.NetworkXDRIncident.ilmmDetails",
18067
- "requestStr": "$IlmmDetails:IlmmDetails ",
18067
+ "requestStr": "$ilmmDetails:IlmmDetails ",
18068
18068
  "required": false,
18069
- "responseStr": "ilmmDetails:$IlmmDetails ",
18069
+ "responseStr": "ilmmDetails:$ilmmDetails ",
18070
18070
  "type": {
18071
18071
  "definition": {
18072
18072
  "description": null,
@@ -18080,9 +18080,9 @@
18080
18080
  "isDeprecated": false,
18081
18081
  "name": "contacts",
18082
18082
  "path": "story.incident.NetworkXDRIncident.ilmmDetails.contacts",
18083
- "requestStr": "$IlmmContact:[IlmmContact] ",
18083
+ "requestStr": "$ilmmContact:[IlmmContact] ",
18084
18084
  "required": false,
18085
- "responseStr": "contacts:$IlmmContact ",
18085
+ "responseStr": "contacts:$ilmmContact ",
18086
18086
  "type": {
18087
18087
  "definition": {
18088
18088
  "description": null,
@@ -18164,7 +18164,7 @@
18164
18164
  "name": "IlmmContact",
18165
18165
  "non_null": false
18166
18166
  },
18167
- "varName": "IlmmContact"
18167
+ "varName": "ilmmContact"
18168
18168
  },
18169
18169
  "ispDetails": {
18170
18170
  "args": {},
@@ -18174,9 +18174,9 @@
18174
18174
  "isDeprecated": false,
18175
18175
  "name": "ispDetails",
18176
18176
  "path": "story.incident.NetworkXDRIncident.ilmmDetails.ispDetails",
18177
- "requestStr": "$IlmmIspDetails:IlmmIspDetails ",
18177
+ "requestStr": "$ilmmIspDetails:IlmmIspDetails ",
18178
18178
  "required": false,
18179
- "responseStr": "ispDetails:$IlmmIspDetails ",
18179
+ "responseStr": "ispDetails:$ilmmIspDetails ",
18180
18180
  "type": {
18181
18181
  "definition": {
18182
18182
  "description": null,
@@ -18250,9 +18250,9 @@
18250
18250
  "isDeprecated": false,
18251
18251
  "name": "loaFile",
18252
18252
  "path": "story.incident.NetworkXDRIncident.ilmmDetails.ispDetails.loaFile",
18253
- "requestStr": "$IspLoaFile:IspLoaFile ",
18253
+ "requestStr": "$ispLoaFile:IspLoaFile ",
18254
18254
  "required": false,
18255
- "responseStr": "loaFile:$IspLoaFile ",
18255
+ "responseStr": "loaFile:$ispLoaFile ",
18256
18256
  "type": {
18257
18257
  "definition": {
18258
18258
  "description": null,
@@ -18332,7 +18332,7 @@
18332
18332
  "name": "IspLoaFile",
18333
18333
  "non_null": false
18334
18334
  },
18335
- "varName": "IspLoaFile"
18335
+ "varName": "ispLoaFile"
18336
18336
  },
18337
18337
  "name": {
18338
18338
  "args": {},
@@ -18408,7 +18408,7 @@
18408
18408
  "name": "IlmmIspDetails",
18409
18409
  "non_null": false
18410
18410
  },
18411
- "varName": "IlmmIspDetails"
18411
+ "varName": "ilmmIspDetails"
18412
18412
  },
18413
18413
  "linkDetails": {
18414
18414
  "args": {},
@@ -18418,9 +18418,9 @@
18418
18418
  "isDeprecated": false,
18419
18419
  "name": "linkDetails",
18420
18420
  "path": "story.incident.NetworkXDRIncident.ilmmDetails.linkDetails",
18421
- "requestStr": "$IlmmLinkDetails:IlmmLinkDetails ",
18421
+ "requestStr": "$ilmmLinkDetails:IlmmLinkDetails ",
18422
18422
  "required": false,
18423
- "responseStr": "linkDetails:$IlmmLinkDetails ",
18423
+ "responseStr": "linkDetails:$ilmmLinkDetails ",
18424
18424
  "type": {
18425
18425
  "definition": {
18426
18426
  "description": null,
@@ -18596,7 +18596,7 @@
18596
18596
  "name": "IlmmLinkDetails",
18597
18597
  "non_null": false
18598
18598
  },
18599
- "varName": "IlmmLinkDetails"
18599
+ "varName": "ilmmLinkDetails"
18600
18600
  }
18601
18601
  },
18602
18602
  "inputFields": null,
@@ -18612,10 +18612,10 @@
18612
18612
  "name": "IlmmDetails",
18613
18613
  "non_null": false
18614
18614
  },
18615
- "varName": "IlmmDetails"
18615
+ "varName": "ilmmDetails"
18616
18616
  },
18617
18617
  "indication": {
18618
- "alias": "NetworkXDRIncidentIndication: indication",
18618
+ "alias": "networkXDRIncidentIndication: indication",
18619
18619
  "args": {},
18620
18620
  "deprecationReason": null,
18621
18621
  "description": null,
@@ -18657,7 +18657,7 @@
18657
18657
  "varName": "isp"
18658
18658
  },
18659
18659
  "lastSignal": {
18660
- "alias": "NetworkXDRIncidentLastSignal: lastSignal",
18660
+ "alias": "networkXDRIncidentLastSignal: lastSignal",
18661
18661
  "args": {},
18662
18662
  "deprecationReason": null,
18663
18663
  "description": null,
@@ -18836,9 +18836,9 @@
18836
18836
  "isDeprecated": false,
18837
18837
  "name": "networkIncidentTimeline",
18838
18838
  "path": "story.incident.NetworkXDRIncident.networkIncidentTimeline",
18839
- "requestStr": "$NetworkTimelineEvent:[NetworkTimelineEvent]! ",
18839
+ "requestStr": "$networkTimelineEvent:[NetworkTimelineEvent]! ",
18840
18840
  "required": true,
18841
- "responseStr": "networkIncidentTimeline:$NetworkTimelineEvent ",
18841
+ "responseStr": "networkIncidentTimeline:$networkTimelineEvent ",
18842
18842
  "type": {
18843
18843
  "definition": {
18844
18844
  "description": null,
@@ -18865,7 +18865,7 @@
18865
18865
  "varName": "acknowledged"
18866
18866
  },
18867
18867
  "bgpConnection": {
18868
- "alias": "BGPConnectionBgpConnection: bgpConnection",
18868
+ "alias": "bGPConnectionBgpConnection: bgpConnection",
18869
18869
  "args": {},
18870
18870
  "deprecationReason": null,
18871
18871
  "description": null,
@@ -18873,9 +18873,9 @@
18873
18873
  "isDeprecated": false,
18874
18874
  "name": "bgpConnection",
18875
18875
  "path": "story.incident.NetworkXDRIncident.networkIncidentTimeline.bgpConnection",
18876
- "requestStr": "$BGPConnection:BGPConnection ",
18876
+ "requestStr": "$bGPConnection:BGPConnection ",
18877
18877
  "required": false,
18878
- "responseStr": "bgpConnection:$BGPConnection ",
18878
+ "responseStr": "bgpConnection:$bGPConnection ",
18879
18879
  "type": {
18880
18880
  "definition": {
18881
18881
  "description": null,
@@ -18995,7 +18995,7 @@
18995
18995
  "name": "BGPConnection",
18996
18996
  "non_null": false
18997
18997
  },
18998
- "varName": "BGPConnection"
18998
+ "varName": "bGPConnection"
18999
18999
  },
19000
19000
  "created": {
19001
19001
  "args": {},
@@ -19039,7 +19039,7 @@
19039
19039
  "varName": "description"
19040
19040
  },
19041
19041
  "deviceConfigHaRole": {
19042
- "alias": "DeviceConfigHaRoleEnumDeviceConfigHaRole: deviceConfigHaRole",
19042
+ "alias": "deviceConfigHaRoleEnumDeviceConfigHaRole: deviceConfigHaRole",
19043
19043
  "args": {},
19044
19044
  "deprecationReason": null,
19045
19045
  "description": null,
@@ -19084,7 +19084,7 @@
19084
19084
  "varName": "deviceConfigHaRole"
19085
19085
  },
19086
19086
  "deviceHaRoleState": {
19087
- "alias": "DeviceHaRoleStateEnumDeviceHaRoleState: deviceHaRoleState",
19087
+ "alias": "deviceHaRoleStateEnumDeviceHaRoleState: deviceHaRoleState",
19088
19088
  "args": {},
19089
19089
  "deprecationReason": null,
19090
19090
  "description": null,
@@ -19152,7 +19152,7 @@
19152
19152
  "varName": "eventIds"
19153
19153
  },
19154
19154
  "eventType": {
19155
- "alias": "NetworkXDREventTypeEnumEventType: eventType",
19155
+ "alias": "networkXDREventTypeEnumEventType: eventType",
19156
19156
  "args": {},
19157
19157
  "deprecationReason": null,
19158
19158
  "description": null,
@@ -19283,7 +19283,7 @@
19283
19283
  "varName": "linkConfigBandwidth"
19284
19284
  },
19285
19285
  "linkConfigPrecedence": {
19286
- "alias": "LinkConfigPrecedenceEnumLinkConfigPrecedence: linkConfigPrecedence",
19286
+ "alias": "linkConfigPrecedenceEnumLinkConfigPrecedence: linkConfigPrecedence",
19287
19287
  "args": {},
19288
19288
  "deprecationReason": null,
19289
19289
  "description": null,
@@ -19374,7 +19374,7 @@
19374
19374
  "varName": "linkName"
19375
19375
  },
19376
19376
  "linkQualityIssue": {
19377
- "alias": "LinkQualityIssueLinkQualityIssue: linkQualityIssue",
19377
+ "alias": "linkQualityIssueLinkQualityIssue: linkQualityIssue",
19378
19378
  "args": {},
19379
19379
  "deprecationReason": null,
19380
19380
  "description": null,
@@ -19382,9 +19382,9 @@
19382
19382
  "isDeprecated": false,
19383
19383
  "name": "linkQualityIssue",
19384
19384
  "path": "story.incident.NetworkXDRIncident.networkIncidentTimeline.linkQualityIssue",
19385
- "requestStr": "$LinkQualityIssue:LinkQualityIssue ",
19385
+ "requestStr": "$linkQualityIssue:LinkQualityIssue ",
19386
19386
  "required": false,
19387
- "responseStr": "linkQualityIssue:$LinkQualityIssue ",
19387
+ "responseStr": "linkQualityIssue:$linkQualityIssue ",
19388
19388
  "type": {
19389
19389
  "definition": {
19390
19390
  "description": null,
@@ -19544,10 +19544,10 @@
19544
19544
  "name": "LinkQualityIssue",
19545
19545
  "non_null": false
19546
19546
  },
19547
- "varName": "LinkQualityIssue"
19547
+ "varName": "linkQualityIssue"
19548
19548
  },
19549
19549
  "linkStatus": {
19550
- "alias": "LinkStatusEnumLinkStatus: linkStatus",
19550
+ "alias": "linkStatusEnumLinkStatus: linkStatus",
19551
19551
  "args": {},
19552
19552
  "deprecationReason": null,
19553
19553
  "description": null,
@@ -19612,7 +19612,7 @@
19612
19612
  "varName": "muted"
19613
19613
  },
19614
19614
  "networkEventSource": {
19615
- "alias": "NetworkEventSourceEnumNetworkEventSource: networkEventSource",
19615
+ "alias": "networkEventSourceEnumNetworkEventSource: networkEventSource",
19616
19616
  "args": {},
19617
19617
  "deprecationReason": null,
19618
19618
  "description": null,
@@ -19804,7 +19804,7 @@
19804
19804
  "name": "NetworkTimelineEvent",
19805
19805
  "non_null": false
19806
19806
  },
19807
- "varName": "NetworkTimelineEvent"
19807
+ "varName": "networkTimelineEvent"
19808
19808
  },
19809
19809
  "occurrences": {
19810
19810
  "args": {},
@@ -19847,7 +19847,7 @@
19847
19847
  "varName": "pop"
19848
19848
  },
19849
19849
  "predictedThreatType": {
19850
- "alias": "NetworkXDRIncidentPredictedThreatType: predictedThreatType",
19850
+ "alias": "networkXDRIncidentPredictedThreatType: predictedThreatType",
19851
19851
  "args": {},
19852
19852
  "deprecationReason": null,
19853
19853
  "description": null,
@@ -19868,7 +19868,7 @@
19868
19868
  "varName": "predictedThreatType"
19869
19869
  },
19870
19870
  "predictedVerdict": {
19871
- "alias": "NetworkXDRIncidentPredictedVerdict: predictedVerdict",
19871
+ "alias": "networkXDRIncidentPredictedVerdict: predictedVerdict",
19872
19872
  "args": {},
19873
19873
  "deprecationReason": null,
19874
19874
  "description": null,
@@ -19925,7 +19925,7 @@
19925
19925
  "varName": "predictedVerdict"
19926
19926
  },
19927
19927
  "producer": {
19928
- "alias": "NetworkXDRIncidentProducer: producer",
19928
+ "alias": "networkXDRIncidentProducer: producer",
19929
19929
  "args": {},
19930
19930
  "deprecationReason": null,
19931
19931
  "description": null,
@@ -20013,7 +20013,7 @@
20013
20013
  "varName": "producer"
20014
20014
  },
20015
20015
  "producerName": {
20016
- "alias": "NetworkXDRIncidentProducerName: producerName",
20016
+ "alias": "networkXDRIncidentProducerName: producerName",
20017
20017
  "args": {},
20018
20018
  "deprecationReason": null,
20019
20019
  "description": null,
@@ -20035,7 +20035,7 @@
20035
20035
  "varName": "producerName"
20036
20036
  },
20037
20037
  "queryName": {
20038
- "alias": "NetworkXDRIncidentQueryName: queryName",
20038
+ "alias": "networkXDRIncidentQueryName: queryName",
20039
20039
  "args": {},
20040
20040
  "deprecationReason": null,
20041
20041
  "description": null,
@@ -20056,7 +20056,7 @@
20056
20056
  "varName": "queryName"
20057
20057
  },
20058
20058
  "research": {
20059
- "alias": "NetworkXDRIncidentResearch: research",
20059
+ "alias": "networkXDRIncidentResearch: research",
20060
20060
  "args": {},
20061
20061
  "deprecationReason": null,
20062
20062
  "description": null,
@@ -20104,9 +20104,9 @@
20104
20104
  "isDeprecated": false,
20105
20105
  "name": "similarStoriesData",
20106
20106
  "path": "story.incident.NetworkXDRIncident.similarStoriesData",
20107
- "requestStr": "$SimilarStoryData:[SimilarStoryData]! ",
20107
+ "requestStr": "$similarStoryData:[SimilarStoryData]! ",
20108
20108
  "required": true,
20109
- "responseStr": "similarStoriesData:$SimilarStoryData ",
20109
+ "responseStr": "similarStoriesData:$similarStoryData ",
20110
20110
  "type": {
20111
20111
  "definition": {
20112
20112
  "description": null,
@@ -20249,10 +20249,10 @@
20249
20249
  "name": "SimilarStoryData",
20250
20250
  "non_null": false
20251
20251
  },
20252
- "varName": "SimilarStoryData"
20252
+ "varName": "similarStoryData"
20253
20253
  },
20254
20254
  "site": {
20255
- "alias": "SiteRef: site",
20255
+ "alias": "siteRef: site",
20256
20256
  "args": {},
20257
20257
  "deprecationReason": null,
20258
20258
  "description": null,
@@ -20260,9 +20260,9 @@
20260
20260
  "isDeprecated": false,
20261
20261
  "name": "site",
20262
20262
  "path": "story.incident.NetworkXDRIncident.site",
20263
- "requestStr": "$SiteRef:SiteRef ",
20263
+ "requestStr": "$siteRef:SiteRef ",
20264
20264
  "required": false,
20265
- "responseStr": "site:$SiteRef ",
20265
+ "responseStr": "site:$siteRef ",
20266
20266
  "type": {
20267
20267
  "definition": {
20268
20268
  "description": null,
@@ -20324,7 +20324,7 @@
20324
20324
  "name": "SiteRef",
20325
20325
  "non_null": false
20326
20326
  },
20327
- "varName": "SiteRef"
20327
+ "varName": "siteRef"
20328
20328
  },
20329
20329
  "siteConfigLocation": {
20330
20330
  "args": {},
@@ -20367,7 +20367,7 @@
20367
20367
  "varName": "siteConnectionType"
20368
20368
  },
20369
20369
  "siteName": {
20370
- "alias": "NetworkXDRIncidentSiteName: siteName",
20370
+ "alias": "networkXDRIncidentSiteName: siteName",
20371
20371
  "args": {},
20372
20372
  "deprecationReason": null,
20373
20373
  "description": null,
@@ -20389,7 +20389,7 @@
20389
20389
  "varName": "siteName"
20390
20390
  },
20391
20391
  "source": {
20392
- "alias": "NetworkXDRIncidentSource: source",
20392
+ "alias": "networkXDRIncidentSource: source",
20393
20393
  "args": {},
20394
20394
  "deprecationReason": null,
20395
20395
  "description": null,
@@ -20410,7 +20410,7 @@
20410
20410
  "varName": "source"
20411
20411
  },
20412
20412
  "sourceIp": {
20413
- "alias": "NetworkXDRIncidentSourceIp: sourceIp",
20413
+ "alias": "networkXDRIncidentSourceIp: sourceIp",
20414
20414
  "args": {},
20415
20415
  "deprecationReason": null,
20416
20416
  "description": null,
@@ -20431,7 +20431,7 @@
20431
20431
  "varName": "sourceIp"
20432
20432
  },
20433
20433
  "status": {
20434
- "alias": "NetworkXDRIncidentStatus: status",
20434
+ "alias": "networkXDRIncidentStatus: status",
20435
20435
  "args": {},
20436
20436
  "deprecationReason": null,
20437
20437
  "description": null,
@@ -20500,7 +20500,7 @@
20500
20500
  "varName": "status"
20501
20501
  },
20502
20502
  "storyDuration": {
20503
- "alias": "NetworkXDRIncidentStoryDuration: storyDuration",
20503
+ "alias": "networkXDRIncidentStoryDuration: storyDuration",
20504
20504
  "args": {},
20505
20505
  "deprecationReason": null,
20506
20506
  "description": null,
@@ -20542,7 +20542,7 @@
20542
20542
  "varName": "storyType"
20543
20543
  },
20544
20544
  "ticket": {
20545
- "alias": "NetworkXDRIncidentTicket: ticket",
20545
+ "alias": "networkXDRIncidentTicket: ticket",
20546
20546
  "args": {},
20547
20547
  "deprecationReason": null,
20548
20548
  "description": null,
@@ -20563,7 +20563,7 @@
20563
20563
  "varName": "ticket"
20564
20564
  },
20565
20565
  "user": {
20566
- "alias": "UserRef: user",
20566
+ "alias": "userRef: user",
20567
20567
  "args": {},
20568
20568
  "deprecationReason": null,
20569
20569
  "description": null,
@@ -20571,9 +20571,9 @@
20571
20571
  "isDeprecated": false,
20572
20572
  "name": "user",
20573
20573
  "path": "story.incident.NetworkXDRIncident.user",
20574
- "requestStr": "$UserRef:UserRef ",
20574
+ "requestStr": "$userRef:UserRef ",
20575
20575
  "required": false,
20576
- "responseStr": "user:$UserRef ",
20576
+ "responseStr": "user:$userRef ",
20577
20577
  "type": {
20578
20578
  "definition": {
20579
20579
  "description": null,
@@ -20635,10 +20635,10 @@
20635
20635
  "name": "UserRef",
20636
20636
  "non_null": false
20637
20637
  },
20638
- "varName": "UserRef"
20638
+ "varName": "userRef"
20639
20639
  },
20640
20640
  "vendor": {
20641
- "alias": "NetworkXDRIncidentVendor: vendor",
20641
+ "alias": "networkXDRIncidentVendor: vendor",
20642
20642
  "args": {},
20643
20643
  "deprecationReason": null,
20644
20644
  "description": null,
@@ -20694,7 +20694,7 @@
20694
20694
  "enumValues": null,
20695
20695
  "fields": {
20696
20696
  "analystFeedback": {
20697
- "alias": "AnalystFeedback: analystFeedback",
20697
+ "alias": "analystFeedback: analystFeedback",
20698
20698
  "args": {},
20699
20699
  "deprecationReason": null,
20700
20700
  "description": "Fields related to analysts research of the threat incident",
@@ -20702,9 +20702,9 @@
20702
20702
  "isDeprecated": false,
20703
20703
  "name": "analystFeedback",
20704
20704
  "path": "story.incident.Threat.analystFeedback",
20705
- "requestStr": "$AnalystFeedback:AnalystFeedback ",
20705
+ "requestStr": "$analystFeedback:AnalystFeedback ",
20706
20706
  "required": false,
20707
- "responseStr": "analystFeedback:$AnalystFeedback ",
20707
+ "responseStr": "analystFeedback:$analystFeedback ",
20708
20708
  "type": {
20709
20709
  "definition": {
20710
20710
  "description": null,
@@ -20808,9 +20808,9 @@
20808
20808
  "isDeprecated": false,
20809
20809
  "name": "threatType",
20810
20810
  "path": "story.incident.Threat.analystFeedback.threatType",
20811
- "requestStr": "$AnalystFeedbackThreatType:AnalystFeedbackThreatType ",
20811
+ "requestStr": "$analystFeedbackThreatType:AnalystFeedbackThreatType ",
20812
20812
  "required": false,
20813
- "responseStr": "threatType:$AnalystFeedbackThreatType ",
20813
+ "responseStr": "threatType:$analystFeedbackThreatType ",
20814
20814
  "type": {
20815
20815
  "definition": {
20816
20816
  "description": null,
@@ -20890,7 +20890,7 @@
20890
20890
  "name": "AnalystFeedbackThreatType",
20891
20891
  "non_null": false
20892
20892
  },
20893
- "varName": "AnalystFeedbackThreatType"
20893
+ "varName": "analystFeedbackThreatType"
20894
20894
  },
20895
20895
  "verdict": {
20896
20896
  "args": {},
@@ -20962,7 +20962,7 @@
20962
20962
  "name": "AnalystFeedback",
20963
20963
  "non_null": false
20964
20964
  },
20965
- "varName": "AnalystFeedback"
20965
+ "varName": "analystFeedback"
20966
20966
  },
20967
20967
  "clientClass": {
20968
20968
  "args": {},
@@ -20988,7 +20988,7 @@
20988
20988
  "varName": "clientClass"
20989
20989
  },
20990
20990
  "connectionType": {
20991
- "alias": "ThreatConnectionType: connectionType",
20991
+ "alias": "threatConnectionType: connectionType",
20992
20992
  "args": {},
20993
20993
  "deprecationReason": null,
20994
20994
  "description": "Enum for the connection for this incident (ie. site, host, user)",
@@ -21039,7 +21039,7 @@
21039
21039
  "varName": "connectionType"
21040
21040
  },
21041
21041
  "criticality": {
21042
- "alias": "ThreatCriticality: criticality",
21042
+ "alias": "threatCriticality: criticality",
21043
21043
  "args": {},
21044
21044
  "deprecationReason": null,
21045
21045
  "description": "Cato's risk analysis of the story. Values are from 1 (low risk) to 10 (high risk)",
@@ -21060,7 +21060,7 @@
21060
21060
  "varName": "criticality"
21061
21061
  },
21062
21062
  "description": {
21063
- "alias": "ThreatDescription: description",
21063
+ "alias": "threatDescription: description",
21064
21064
  "args": {},
21065
21065
  "deprecationReason": null,
21066
21066
  "description": "Description of the threat",
@@ -21121,7 +21121,7 @@
21121
21121
  "varName": "direction"
21122
21122
  },
21123
21123
  "engineType": {
21124
- "alias": "ThreatEngineType: engineType",
21124
+ "alias": "threatEngineType: engineType",
21125
21125
  "args": {},
21126
21126
  "deprecationReason": null,
21127
21127
  "description": "XDR engine involved with the incident",
@@ -21191,9 +21191,9 @@
21191
21191
  "isDeprecated": false,
21192
21192
  "name": "events",
21193
21193
  "path": "story.incident.Threat.events",
21194
- "requestStr": "$Event:[Event] ",
21194
+ "requestStr": "$event:[Event] ",
21195
21195
  "required": false,
21196
- "responseStr": "events:$Event ",
21196
+ "responseStr": "events:$event ",
21197
21197
  "type": {
21198
21198
  "definition": {
21199
21199
  "description": null,
@@ -21320,7 +21320,7 @@
21320
21320
  "varName": "ruleId"
21321
21321
  },
21322
21322
  "scanResult": {
21323
- "alias": "ScanResultScanResult: scanResult",
21323
+ "alias": "scanResultScanResult: scanResult",
21324
21324
  "args": {},
21325
21325
  "deprecationReason": null,
21326
21326
  "description": null,
@@ -21510,10 +21510,10 @@
21510
21510
  "name": "Event",
21511
21511
  "non_null": false
21512
21512
  },
21513
- "varName": "Event"
21513
+ "varName": "event"
21514
21514
  },
21515
21515
  "firstSignal": {
21516
- "alias": "ThreatFirstSignal: firstSignal",
21516
+ "alias": "threatFirstSignal: firstSignal",
21517
21517
  "args": {},
21518
21518
  "deprecationReason": null,
21519
21519
  "description": "Timestamp for the first incident signal related to this story",
@@ -21542,9 +21542,9 @@
21542
21542
  "isDeprecated": false,
21543
21543
  "name": "flows",
21544
21544
  "path": "story.incident.Threat.flows",
21545
- "requestStr": "$IncidentFlow:[IncidentFlow] ",
21545
+ "requestStr": "$incidentFlow:[IncidentFlow] ",
21546
21546
  "required": false,
21547
- "responseStr": "flows:$IncidentFlow ",
21547
+ "responseStr": "flows:$incidentFlow ",
21548
21548
  "type": {
21549
21549
  "definition": {
21550
21550
  "description": null,
@@ -22046,7 +22046,7 @@
22046
22046
  "name": "IncidentFlow",
22047
22047
  "non_null": false
22048
22048
  },
22049
- "varName": "IncidentFlow"
22049
+ "varName": "incidentFlow"
22050
22050
  },
22051
22051
  "flowsCardinality": {
22052
22052
  "args": {},
@@ -22069,7 +22069,7 @@
22069
22069
  "varName": "flowsCardinality"
22070
22070
  },
22071
22071
  "id": {
22072
- "alias": "ThreatId: id",
22072
+ "alias": "threatId: id",
22073
22073
  "args": {},
22074
22074
  "deprecationReason": null,
22075
22075
  "description": "Unique Cato ID for this threat",
@@ -22091,7 +22091,7 @@
22091
22091
  "varName": "id"
22092
22092
  },
22093
22093
  "indication": {
22094
- "alias": "ThreatIndication: indication",
22094
+ "alias": "threatIndication: indication",
22095
22095
  "args": {},
22096
22096
  "deprecationReason": null,
22097
22097
  "description": "An indication is a set of actions and behaviors for the Network or Security incident. Each producer has different indications.",
@@ -22113,7 +22113,7 @@
22113
22113
  "varName": "indication"
22114
22114
  },
22115
22115
  "lastSignal": {
22116
- "alias": "ThreatLastSignal: lastSignal",
22116
+ "alias": "threatLastSignal: lastSignal",
22117
22117
  "args": {},
22118
22118
  "deprecationReason": null,
22119
22119
  "description": "Timestamp for the first incident signal related to this story",
@@ -22182,9 +22182,9 @@
22182
22182
  "isDeprecated": false,
22183
22183
  "name": "mitres",
22184
22184
  "path": "story.incident.Threat.mitres",
22185
- "requestStr": "$Mitre:[Mitre] ",
22185
+ "requestStr": "$mitre:[Mitre] ",
22186
22186
  "required": false,
22187
- "responseStr": "mitres:$Mitre ",
22187
+ "responseStr": "mitres:$mitre ",
22188
22188
  "type": {
22189
22189
  "definition": {
22190
22190
  "description": null,
@@ -22246,7 +22246,7 @@
22246
22246
  "name": "Mitre",
22247
22247
  "non_null": false
22248
22248
  },
22249
- "varName": "Mitre"
22249
+ "varName": "mitre"
22250
22250
  },
22251
22251
  "os": {
22252
22252
  "args": {},
@@ -22269,7 +22269,7 @@
22269
22269
  "varName": "os"
22270
22270
  },
22271
22271
  "predictedThreatType": {
22272
- "alias": "ThreatPredictedThreatType: predictedThreatType",
22272
+ "alias": "threatPredictedThreatType: predictedThreatType",
22273
22273
  "args": {},
22274
22274
  "deprecationReason": null,
22275
22275
  "description": "Cato\u2019s predicted threat type for the story",
@@ -22290,7 +22290,7 @@
22290
22290
  "varName": "predictedThreatType"
22291
22291
  },
22292
22292
  "predictedVerdict": {
22293
- "alias": "ThreatPredictedVerdict: predictedVerdict",
22293
+ "alias": "threatPredictedVerdict: predictedVerdict",
22294
22294
  "args": {},
22295
22295
  "deprecationReason": null,
22296
22296
  "description": "Enum for Cato\u2019s predicted verdict of the story (ie. Malicious, Benign)",
@@ -22347,7 +22347,7 @@
22347
22347
  "varName": "predictedVerdict"
22348
22348
  },
22349
22349
  "producer": {
22350
- "alias": "ThreatProducer: producer",
22350
+ "alias": "threatProducer: producer",
22351
22351
  "args": {},
22352
22352
  "deprecationReason": null,
22353
22353
  "description": "Enum for the Producer (specific XDR engine and service) involved with the incident",
@@ -22435,7 +22435,7 @@
22435
22435
  "varName": "producer"
22436
22436
  },
22437
22437
  "producerName": {
22438
- "alias": "ThreatProducerName: producerName",
22438
+ "alias": "threatProducerName: producerName",
22439
22439
  "args": {},
22440
22440
  "deprecationReason": null,
22441
22441
  "description": "Full name of the Producer (specific XDR engine and service) involved with the incident",
@@ -22457,7 +22457,7 @@
22457
22457
  "varName": "producerName"
22458
22458
  },
22459
22459
  "queryName": {
22460
- "alias": "ThreatQueryName: queryName",
22460
+ "alias": "threatQueryName: queryName",
22461
22461
  "args": {},
22462
22462
  "deprecationReason": null,
22463
22463
  "description": "Category for the indication ID related to the story",
@@ -22478,7 +22478,7 @@
22478
22478
  "varName": "queryName"
22479
22479
  },
22480
22480
  "research": {
22481
- "alias": "ThreatResearch: research",
22481
+ "alias": "threatResearch: research",
22482
22482
  "args": {},
22483
22483
  "deprecationReason": null,
22484
22484
  "description": "The value is TRUE when the story is currently being researched by Security Analysts",
@@ -22580,9 +22580,9 @@
22580
22580
  "isDeprecated": false,
22581
22581
  "name": "similarStoriesData",
22582
22582
  "path": "story.incident.Threat.similarStoriesData",
22583
- "requestStr": "$SimilarStoryData:[SimilarStoryData]! ",
22583
+ "requestStr": "$similarStoryData:[SimilarStoryData]! ",
22584
22584
  "required": true,
22585
- "responseStr": "similarStoriesData:$SimilarStoryData ",
22585
+ "responseStr": "similarStoriesData:$similarStoryData ",
22586
22586
  "type": {
22587
22587
  "definition": {
22588
22588
  "description": null,
@@ -22725,10 +22725,10 @@
22725
22725
  "name": "SimilarStoryData",
22726
22726
  "non_null": false
22727
22727
  },
22728
- "varName": "SimilarStoryData"
22728
+ "varName": "similarStoryData"
22729
22729
  },
22730
22730
  "site": {
22731
- "alias": "SiteRef: site",
22731
+ "alias": "siteRef: site",
22732
22732
  "args": {},
22733
22733
  "deprecationReason": null,
22734
22734
  "description": "Cato ID and name for the site",
@@ -22736,9 +22736,9 @@
22736
22736
  "isDeprecated": false,
22737
22737
  "name": "site",
22738
22738
  "path": "story.incident.Threat.site",
22739
- "requestStr": "$SiteRef:SiteRef ",
22739
+ "requestStr": "$siteRef:SiteRef ",
22740
22740
  "required": false,
22741
- "responseStr": "site:$SiteRef ",
22741
+ "responseStr": "site:$siteRef ",
22742
22742
  "type": {
22743
22743
  "definition": {
22744
22744
  "description": null,
@@ -22800,10 +22800,10 @@
22800
22800
  "name": "SiteRef",
22801
22801
  "non_null": false
22802
22802
  },
22803
- "varName": "SiteRef"
22803
+ "varName": "siteRef"
22804
22804
  },
22805
22805
  "siteName": {
22806
- "alias": "ThreatSiteName: siteName",
22806
+ "alias": "threatSiteName: siteName",
22807
22807
  "args": {},
22808
22808
  "deprecationReason": null,
22809
22809
  "description": "Site name related to the story",
@@ -22824,7 +22824,7 @@
22824
22824
  "varName": "siteName"
22825
22825
  },
22826
22826
  "source": {
22827
- "alias": "ThreatSource: source",
22827
+ "alias": "threatSource: source",
22828
22828
  "args": {},
22829
22829
  "deprecationReason": null,
22830
22830
  "description": "IP address, name of device, or SDP user on your network involved in the story",
@@ -22845,7 +22845,7 @@
22845
22845
  "varName": "source"
22846
22846
  },
22847
22847
  "sourceIp": {
22848
- "alias": "ThreatSourceIp: sourceIp",
22848
+ "alias": "threatSourceIp: sourceIp",
22849
22849
  "args": {},
22850
22850
  "deprecationReason": null,
22851
22851
  "description": "The source IP address of the device in your network sending or receiving the flow",
@@ -22886,7 +22886,7 @@
22886
22886
  "varName": "srcSiteId"
22887
22887
  },
22888
22888
  "status": {
22889
- "alias": "ThreatStatus: status",
22889
+ "alias": "threatStatus: status",
22890
22890
  "args": {},
22891
22891
  "deprecationReason": null,
22892
22892
  "description": "Enum for the status of this story (ie. Open, Closed, Monitoring)",
@@ -22955,7 +22955,7 @@
22955
22955
  "varName": "status"
22956
22956
  },
22957
22957
  "storyDuration": {
22958
- "alias": "ThreatStoryDuration: storyDuration",
22958
+ "alias": "threatStoryDuration: storyDuration",
22959
22959
  "args": {},
22960
22960
  "deprecationReason": null,
22961
22961
  "description": "Amount of time since the story was opened (no value for closed stories)",
@@ -22983,9 +22983,9 @@
22983
22983
  "isDeprecated": false,
22984
22984
  "name": "targets",
22985
22985
  "path": "story.incident.Threat.targets",
22986
- "requestStr": "$IncidentTargetRep:[IncidentTargetRep]! ",
22986
+ "requestStr": "$incidentTargetRep:[IncidentTargetRep]! ",
22987
22987
  "required": true,
22988
- "responseStr": "targets:$IncidentTargetRep ",
22988
+ "responseStr": "targets:$incidentTargetRep ",
22989
22989
  "type": {
22990
22990
  "definition": {
22991
22991
  "description": null,
@@ -23112,7 +23112,7 @@
23112
23112
  "varName": "engines"
23113
23113
  },
23114
23114
  "eventData": {
23115
- "alias": "EventEventData: eventData",
23115
+ "alias": "eventEventData: eventData",
23116
23116
  "args": {},
23117
23117
  "deprecationReason": null,
23118
23118
  "description": null,
@@ -23120,9 +23120,9 @@
23120
23120
  "isDeprecated": false,
23121
23121
  "name": "eventData",
23122
23122
  "path": "story.incident.Threat.targets.eventData",
23123
- "requestStr": "$Event:[Event]! ",
23123
+ "requestStr": "$event:[Event]! ",
23124
23124
  "required": true,
23125
- "responseStr": "eventData:$Event ",
23125
+ "responseStr": "eventData:$event ",
23126
23126
  "type": {
23127
23127
  "definition": {
23128
23128
  "description": null,
@@ -23249,7 +23249,7 @@
23249
23249
  "varName": "ruleId"
23250
23250
  },
23251
23251
  "scanResult": {
23252
- "alias": "ScanResultScanResult: scanResult",
23252
+ "alias": "scanResultScanResult: scanResult",
23253
23253
  "args": {},
23254
23254
  "deprecationReason": null,
23255
23255
  "description": null,
@@ -23440,7 +23440,7 @@
23440
23440
  "name": "Event",
23441
23441
  "non_null": false
23442
23442
  },
23443
- "varName": "Event"
23443
+ "varName": "event"
23444
23444
  },
23445
23445
  "infectionSource": {
23446
23446
  "args": {},
@@ -23543,7 +23543,7 @@
23543
23543
  "varName": "threatReference"
23544
23544
  },
23545
23545
  "type": {
23546
- "alias": "TargetTypeType: type",
23546
+ "alias": "targetTypeType: type",
23547
23547
  "args": {},
23548
23548
  "deprecationReason": null,
23549
23549
  "description": null,
@@ -23616,10 +23616,10 @@
23616
23616
  "name": "IncidentTargetRep",
23617
23617
  "non_null": false
23618
23618
  },
23619
- "varName": "IncidentTargetRep"
23619
+ "varName": "incidentTargetRep"
23620
23620
  },
23621
23621
  "ticket": {
23622
- "alias": "ThreatTicket: ticket",
23622
+ "alias": "threatTicket: ticket",
23623
23623
  "args": {},
23624
23624
  "deprecationReason": null,
23625
23625
  "description": "The ticket an analyst created for this story",
@@ -23647,9 +23647,9 @@
23647
23647
  "isDeprecated": false,
23648
23648
  "name": "timeSeries",
23649
23649
  "path": "story.incident.Threat.timeSeries",
23650
- "requestStr": "$IncidentTimeseries:[IncidentTimeseries] ",
23650
+ "requestStr": "$incidentTimeseries:[IncidentTimeseries] ",
23651
23651
  "required": false,
23652
- "responseStr": "timeSeries:$IncidentTimeseries ",
23652
+ "responseStr": "timeSeries:$incidentTimeseries ",
23653
23653
  "type": {
23654
23654
  "definition": {
23655
23655
  "description": null,
@@ -23720,7 +23720,7 @@
23720
23720
  "varName": "info"
23721
23721
  },
23722
23722
  "key": {
23723
- "alias": "TimeseriesKeyKey: key",
23723
+ "alias": "timeseriesKeyKey: key",
23724
23724
  "args": {},
23725
23725
  "deprecationReason": null,
23726
23726
  "description": null,
@@ -23728,9 +23728,9 @@
23728
23728
  "isDeprecated": false,
23729
23729
  "name": "key",
23730
23730
  "path": "story.incident.Threat.timeSeries.key",
23731
- "requestStr": "$TimeseriesKey:TimeseriesKey ",
23731
+ "requestStr": "$timeseriesKey:TimeseriesKey ",
23732
23732
  "required": false,
23733
- "responseStr": "key:$TimeseriesKey ",
23733
+ "responseStr": "key:$timeseriesKey ",
23734
23734
  "type": {
23735
23735
  "definition": {
23736
23736
  "description": null,
@@ -23744,9 +23744,9 @@
23744
23744
  "isDeprecated": false,
23745
23745
  "name": "dimensions",
23746
23746
  "path": "story.incident.Threat.timeSeries.key.dimensions",
23747
- "requestStr": "$DimensionKey:[DimensionKey] ",
23747
+ "requestStr": "$dimensionKey:[DimensionKey] ",
23748
23748
  "required": false,
23749
- "responseStr": "dimensions:$DimensionKey ",
23749
+ "responseStr": "dimensions:$dimensionKey ",
23750
23750
  "type": {
23751
23751
  "definition": {
23752
23752
  "description": null,
@@ -23809,7 +23809,7 @@
23809
23809
  "name": "DimensionKey",
23810
23810
  "non_null": false
23811
23811
  },
23812
- "varName": "DimensionKey"
23812
+ "varName": "dimensionKey"
23813
23813
  },
23814
23814
  "measureFieldName": {
23815
23815
  "args": {},
@@ -23846,7 +23846,7 @@
23846
23846
  "name": "TimeseriesKey",
23847
23847
  "non_null": false
23848
23848
  },
23849
- "varName": "TimeseriesKey"
23849
+ "varName": "timeseriesKey"
23850
23850
  },
23851
23851
  "label": {
23852
23852
  "args": {},
@@ -23890,7 +23890,7 @@
23890
23890
  "varName": "sum"
23891
23891
  },
23892
23892
  "units": {
23893
- "alias": "UnitTypeUnits: units",
23893
+ "alias": "unitTypeUnits: units",
23894
23894
  "args": {},
23895
23895
  "deprecationReason": null,
23896
23896
  "description": "Identifies what unit of data this timeseries represents. Note that toRate is only available for particular types\nof data to make sense.",
@@ -24004,10 +24004,10 @@
24004
24004
  "name": "IncidentTimeseries",
24005
24005
  "non_null": false
24006
24006
  },
24007
- "varName": "IncidentTimeseries"
24007
+ "varName": "incidentTimeseries"
24008
24008
  },
24009
24009
  "user": {
24010
- "alias": "UserRef: user",
24010
+ "alias": "userRef: user",
24011
24011
  "args": {},
24012
24012
  "deprecationReason": null,
24013
24013
  "description": "Cato ID and name for the user",
@@ -24015,9 +24015,9 @@
24015
24015
  "isDeprecated": false,
24016
24016
  "name": "user",
24017
24017
  "path": "story.incident.Threat.user",
24018
- "requestStr": "$UserRef:UserRef ",
24018
+ "requestStr": "$userRef:UserRef ",
24019
24019
  "required": false,
24020
- "responseStr": "user:$UserRef ",
24020
+ "responseStr": "user:$userRef ",
24021
24021
  "type": {
24022
24022
  "definition": {
24023
24023
  "description": null,
@@ -24079,10 +24079,10 @@
24079
24079
  "name": "UserRef",
24080
24080
  "non_null": false
24081
24081
  },
24082
- "varName": "UserRef"
24082
+ "varName": "userRef"
24083
24083
  },
24084
24084
  "vendor": {
24085
- "alias": "ThreatVendor: vendor",
24085
+ "alias": "threatVendor: vendor",
24086
24086
  "args": {},
24087
24087
  "deprecationReason": null,
24088
24088
  "description": "Vendor that identified the incident, such as Cato or Microsoft",
@@ -24138,7 +24138,7 @@
24138
24138
  "enumValues": null,
24139
24139
  "fields": {
24140
24140
  "analystFeedback": {
24141
- "alias": "AnalystFeedback: analystFeedback",
24141
+ "alias": "analystFeedback: analystFeedback",
24142
24142
  "args": {},
24143
24143
  "deprecationReason": null,
24144
24144
  "description": null,
@@ -24146,9 +24146,9 @@
24146
24146
  "isDeprecated": false,
24147
24147
  "name": "analystFeedback",
24148
24148
  "path": "story.incident.ThreatPrevention.analystFeedback",
24149
- "requestStr": "$AnalystFeedback:AnalystFeedback ",
24149
+ "requestStr": "$analystFeedback:AnalystFeedback ",
24150
24150
  "required": false,
24151
- "responseStr": "analystFeedback:$AnalystFeedback ",
24151
+ "responseStr": "analystFeedback:$analystFeedback ",
24152
24152
  "type": {
24153
24153
  "definition": {
24154
24154
  "description": null,
@@ -24252,9 +24252,9 @@
24252
24252
  "isDeprecated": false,
24253
24253
  "name": "threatType",
24254
24254
  "path": "story.incident.ThreatPrevention.analystFeedback.threatType",
24255
- "requestStr": "$AnalystFeedbackThreatType:AnalystFeedbackThreatType ",
24255
+ "requestStr": "$analystFeedbackThreatType:AnalystFeedbackThreatType ",
24256
24256
  "required": false,
24257
- "responseStr": "threatType:$AnalystFeedbackThreatType ",
24257
+ "responseStr": "threatType:$analystFeedbackThreatType ",
24258
24258
  "type": {
24259
24259
  "definition": {
24260
24260
  "description": null,
@@ -24334,7 +24334,7 @@
24334
24334
  "name": "AnalystFeedbackThreatType",
24335
24335
  "non_null": false
24336
24336
  },
24337
- "varName": "AnalystFeedbackThreatType"
24337
+ "varName": "analystFeedbackThreatType"
24338
24338
  },
24339
24339
  "verdict": {
24340
24340
  "args": {},
@@ -24406,7 +24406,7 @@
24406
24406
  "name": "AnalystFeedback",
24407
24407
  "non_null": false
24408
24408
  },
24409
- "varName": "AnalystFeedback"
24409
+ "varName": "analystFeedback"
24410
24410
  },
24411
24411
  "clientClass": {
24412
24412
  "args": {},
@@ -24432,7 +24432,7 @@
24432
24432
  "varName": "clientClass"
24433
24433
  },
24434
24434
  "connectionType": {
24435
- "alias": "ThreatPreventionConnectionType: connectionType",
24435
+ "alias": "threatPreventionConnectionType: connectionType",
24436
24436
  "args": {},
24437
24437
  "deprecationReason": null,
24438
24438
  "description": null,
@@ -24483,7 +24483,7 @@
24483
24483
  "varName": "connectionType"
24484
24484
  },
24485
24485
  "criticality": {
24486
- "alias": "ThreatPreventionCriticality: criticality",
24486
+ "alias": "threatPreventionCriticality: criticality",
24487
24487
  "args": {},
24488
24488
  "deprecationReason": null,
24489
24489
  "description": null,
@@ -24504,7 +24504,7 @@
24504
24504
  "varName": "criticality"
24505
24505
  },
24506
24506
  "description": {
24507
- "alias": "ThreatPreventionDescription: description",
24507
+ "alias": "threatPreventionDescription: description",
24508
24508
  "args": {},
24509
24509
  "deprecationReason": null,
24510
24510
  "description": null,
@@ -24565,7 +24565,7 @@
24565
24565
  "varName": "direction"
24566
24566
  },
24567
24567
  "engineType": {
24568
- "alias": "ThreatPreventionEngineType: engineType",
24568
+ "alias": "threatPreventionEngineType: engineType",
24569
24569
  "args": {},
24570
24570
  "deprecationReason": null,
24571
24571
  "description": null,
@@ -24635,9 +24635,9 @@
24635
24635
  "isDeprecated": false,
24636
24636
  "name": "events",
24637
24637
  "path": "story.incident.ThreatPrevention.events",
24638
- "requestStr": "$Event:[Event] ",
24638
+ "requestStr": "$event:[Event] ",
24639
24639
  "required": false,
24640
- "responseStr": "events:$Event ",
24640
+ "responseStr": "events:$event ",
24641
24641
  "type": {
24642
24642
  "definition": {
24643
24643
  "description": null,
@@ -24764,7 +24764,7 @@
24764
24764
  "varName": "ruleId"
24765
24765
  },
24766
24766
  "scanResult": {
24767
- "alias": "ScanResultScanResult: scanResult",
24767
+ "alias": "scanResultScanResult: scanResult",
24768
24768
  "args": {},
24769
24769
  "deprecationReason": null,
24770
24770
  "description": null,
@@ -24954,10 +24954,10 @@
24954
24954
  "name": "Event",
24955
24955
  "non_null": false
24956
24956
  },
24957
- "varName": "Event"
24957
+ "varName": "event"
24958
24958
  },
24959
24959
  "firstSignal": {
24960
- "alias": "ThreatPreventionFirstSignal: firstSignal",
24960
+ "alias": "threatPreventionFirstSignal: firstSignal",
24961
24961
  "args": {},
24962
24962
  "deprecationReason": null,
24963
24963
  "description": null,
@@ -24999,7 +24999,7 @@
24999
24999
  "varName": "flowsCardinality"
25000
25000
  },
25001
25001
  "id": {
25002
- "alias": "ThreatPreventionId: id",
25002
+ "alias": "threatPreventionId: id",
25003
25003
  "args": {},
25004
25004
  "deprecationReason": null,
25005
25005
  "description": null,
@@ -25021,7 +25021,7 @@
25021
25021
  "varName": "id"
25022
25022
  },
25023
25023
  "indication": {
25024
- "alias": "ThreatPreventionIndication: indication",
25024
+ "alias": "threatPreventionIndication: indication",
25025
25025
  "args": {},
25026
25026
  "deprecationReason": null,
25027
25027
  "description": null,
@@ -25043,7 +25043,7 @@
25043
25043
  "varName": "indication"
25044
25044
  },
25045
25045
  "lastSignal": {
25046
- "alias": "ThreatPreventionLastSignal: lastSignal",
25046
+ "alias": "threatPreventionLastSignal: lastSignal",
25047
25047
  "args": {},
25048
25048
  "deprecationReason": null,
25049
25049
  "description": null,
@@ -25112,9 +25112,9 @@
25112
25112
  "isDeprecated": false,
25113
25113
  "name": "mitres",
25114
25114
  "path": "story.incident.ThreatPrevention.mitres",
25115
- "requestStr": "$Mitre:[Mitre] ",
25115
+ "requestStr": "$mitre:[Mitre] ",
25116
25116
  "required": false,
25117
- "responseStr": "mitres:$Mitre ",
25117
+ "responseStr": "mitres:$mitre ",
25118
25118
  "type": {
25119
25119
  "definition": {
25120
25120
  "description": null,
@@ -25176,7 +25176,7 @@
25176
25176
  "name": "Mitre",
25177
25177
  "non_null": false
25178
25178
  },
25179
- "varName": "Mitre"
25179
+ "varName": "mitre"
25180
25180
  },
25181
25181
  "os": {
25182
25182
  "args": {},
@@ -25199,7 +25199,7 @@
25199
25199
  "varName": "os"
25200
25200
  },
25201
25201
  "predictedThreatType": {
25202
- "alias": "ThreatPreventionPredictedThreatType: predictedThreatType",
25202
+ "alias": "threatPreventionPredictedThreatType: predictedThreatType",
25203
25203
  "args": {},
25204
25204
  "deprecationReason": null,
25205
25205
  "description": null,
@@ -25220,7 +25220,7 @@
25220
25220
  "varName": "predictedThreatType"
25221
25221
  },
25222
25222
  "predictedVerdict": {
25223
- "alias": "ThreatPreventionPredictedVerdict: predictedVerdict",
25223
+ "alias": "threatPreventionPredictedVerdict: predictedVerdict",
25224
25224
  "args": {},
25225
25225
  "deprecationReason": null,
25226
25226
  "description": null,
@@ -25277,7 +25277,7 @@
25277
25277
  "varName": "predictedVerdict"
25278
25278
  },
25279
25279
  "producer": {
25280
- "alias": "ThreatPreventionProducer: producer",
25280
+ "alias": "threatPreventionProducer: producer",
25281
25281
  "args": {},
25282
25282
  "deprecationReason": null,
25283
25283
  "description": null,
@@ -25365,7 +25365,7 @@
25365
25365
  "varName": "producer"
25366
25366
  },
25367
25367
  "producerName": {
25368
- "alias": "ThreatPreventionProducerName: producerName",
25368
+ "alias": "threatPreventionProducerName: producerName",
25369
25369
  "args": {},
25370
25370
  "deprecationReason": null,
25371
25371
  "description": null,
@@ -25387,7 +25387,7 @@
25387
25387
  "varName": "producerName"
25388
25388
  },
25389
25389
  "queryName": {
25390
- "alias": "ThreatPreventionQueryName: queryName",
25390
+ "alias": "threatPreventionQueryName: queryName",
25391
25391
  "args": {},
25392
25392
  "deprecationReason": null,
25393
25393
  "description": null,
@@ -25408,7 +25408,7 @@
25408
25408
  "varName": "queryName"
25409
25409
  },
25410
25410
  "research": {
25411
- "alias": "ThreatPreventionResearch: research",
25411
+ "alias": "threatPreventionResearch: research",
25412
25412
  "args": {},
25413
25413
  "deprecationReason": null,
25414
25414
  "description": null,
@@ -25510,9 +25510,9 @@
25510
25510
  "isDeprecated": false,
25511
25511
  "name": "similarStoriesData",
25512
25512
  "path": "story.incident.ThreatPrevention.similarStoriesData",
25513
- "requestStr": "$SimilarStoryData:[SimilarStoryData]! ",
25513
+ "requestStr": "$similarStoryData:[SimilarStoryData]! ",
25514
25514
  "required": true,
25515
- "responseStr": "similarStoriesData:$SimilarStoryData ",
25515
+ "responseStr": "similarStoriesData:$similarStoryData ",
25516
25516
  "type": {
25517
25517
  "definition": {
25518
25518
  "description": null,
@@ -25655,10 +25655,10 @@
25655
25655
  "name": "SimilarStoryData",
25656
25656
  "non_null": false
25657
25657
  },
25658
- "varName": "SimilarStoryData"
25658
+ "varName": "similarStoryData"
25659
25659
  },
25660
25660
  "site": {
25661
- "alias": "SiteRef: site",
25661
+ "alias": "siteRef: site",
25662
25662
  "args": {},
25663
25663
  "deprecationReason": null,
25664
25664
  "description": null,
@@ -25666,9 +25666,9 @@
25666
25666
  "isDeprecated": false,
25667
25667
  "name": "site",
25668
25668
  "path": "story.incident.ThreatPrevention.site",
25669
- "requestStr": "$SiteRef:SiteRef ",
25669
+ "requestStr": "$siteRef:SiteRef ",
25670
25670
  "required": false,
25671
- "responseStr": "site:$SiteRef ",
25671
+ "responseStr": "site:$siteRef ",
25672
25672
  "type": {
25673
25673
  "definition": {
25674
25674
  "description": null,
@@ -25730,10 +25730,10 @@
25730
25730
  "name": "SiteRef",
25731
25731
  "non_null": false
25732
25732
  },
25733
- "varName": "SiteRef"
25733
+ "varName": "siteRef"
25734
25734
  },
25735
25735
  "siteName": {
25736
- "alias": "ThreatPreventionSiteName: siteName",
25736
+ "alias": "threatPreventionSiteName: siteName",
25737
25737
  "args": {},
25738
25738
  "deprecationReason": null,
25739
25739
  "description": null,
@@ -25754,7 +25754,7 @@
25754
25754
  "varName": "siteName"
25755
25755
  },
25756
25756
  "source": {
25757
- "alias": "ThreatPreventionSource: source",
25757
+ "alias": "threatPreventionSource: source",
25758
25758
  "args": {},
25759
25759
  "deprecationReason": null,
25760
25760
  "description": null,
@@ -25775,7 +25775,7 @@
25775
25775
  "varName": "source"
25776
25776
  },
25777
25777
  "sourceIp": {
25778
- "alias": "ThreatPreventionSourceIp: sourceIp",
25778
+ "alias": "threatPreventionSourceIp: sourceIp",
25779
25779
  "args": {},
25780
25780
  "deprecationReason": null,
25781
25781
  "description": null,
@@ -25816,7 +25816,7 @@
25816
25816
  "varName": "srcSiteId"
25817
25817
  },
25818
25818
  "status": {
25819
- "alias": "ThreatPreventionStatus: status",
25819
+ "alias": "threatPreventionStatus: status",
25820
25820
  "args": {},
25821
25821
  "deprecationReason": null,
25822
25822
  "description": null,
@@ -25885,7 +25885,7 @@
25885
25885
  "varName": "status"
25886
25886
  },
25887
25887
  "storyDuration": {
25888
- "alias": "ThreatPreventionStoryDuration: storyDuration",
25888
+ "alias": "threatPreventionStoryDuration: storyDuration",
25889
25889
  "args": {},
25890
25890
  "deprecationReason": null,
25891
25891
  "description": null,
@@ -25913,9 +25913,9 @@
25913
25913
  "isDeprecated": false,
25914
25914
  "name": "targets",
25915
25915
  "path": "story.incident.ThreatPrevention.targets",
25916
- "requestStr": "$IncidentTargetRep:[IncidentTargetRep]! ",
25916
+ "requestStr": "$incidentTargetRep:[IncidentTargetRep]! ",
25917
25917
  "required": true,
25918
- "responseStr": "targets:$IncidentTargetRep ",
25918
+ "responseStr": "targets:$incidentTargetRep ",
25919
25919
  "type": {
25920
25920
  "definition": {
25921
25921
  "description": null,
@@ -26042,7 +26042,7 @@
26042
26042
  "varName": "engines"
26043
26043
  },
26044
26044
  "eventData": {
26045
- "alias": "EventEventData: eventData",
26045
+ "alias": "eventEventData: eventData",
26046
26046
  "args": {},
26047
26047
  "deprecationReason": null,
26048
26048
  "description": null,
@@ -26050,9 +26050,9 @@
26050
26050
  "isDeprecated": false,
26051
26051
  "name": "eventData",
26052
26052
  "path": "story.incident.ThreatPrevention.targets.eventData",
26053
- "requestStr": "$Event:[Event]! ",
26053
+ "requestStr": "$event:[Event]! ",
26054
26054
  "required": true,
26055
- "responseStr": "eventData:$Event ",
26055
+ "responseStr": "eventData:$event ",
26056
26056
  "type": {
26057
26057
  "definition": {
26058
26058
  "description": null,
@@ -26179,7 +26179,7 @@
26179
26179
  "varName": "ruleId"
26180
26180
  },
26181
26181
  "scanResult": {
26182
- "alias": "ScanResultScanResult: scanResult",
26182
+ "alias": "scanResultScanResult: scanResult",
26183
26183
  "args": {},
26184
26184
  "deprecationReason": null,
26185
26185
  "description": null,
@@ -26370,7 +26370,7 @@
26370
26370
  "name": "Event",
26371
26371
  "non_null": false
26372
26372
  },
26373
- "varName": "Event"
26373
+ "varName": "event"
26374
26374
  },
26375
26375
  "infectionSource": {
26376
26376
  "args": {},
@@ -26473,7 +26473,7 @@
26473
26473
  "varName": "threatReference"
26474
26474
  },
26475
26475
  "type": {
26476
- "alias": "TargetTypeType: type",
26476
+ "alias": "targetTypeType: type",
26477
26477
  "args": {},
26478
26478
  "deprecationReason": null,
26479
26479
  "description": null,
@@ -26546,7 +26546,7 @@
26546
26546
  "name": "IncidentTargetRep",
26547
26547
  "non_null": false
26548
26548
  },
26549
- "varName": "IncidentTargetRep"
26549
+ "varName": "incidentTargetRep"
26550
26550
  },
26551
26551
  "threatPreventionsEvents": {
26552
26552
  "args": {},
@@ -26556,9 +26556,9 @@
26556
26556
  "isDeprecated": false,
26557
26557
  "name": "threatPreventionsEvents",
26558
26558
  "path": "story.incident.ThreatPrevention.threatPreventionsEvents",
26559
- "requestStr": "$ThreatPreventionEvents:[ThreatPreventionEvents] ",
26559
+ "requestStr": "$threatPreventionEvents:[ThreatPreventionEvents] ",
26560
26560
  "required": false,
26561
- "responseStr": "threatPreventionsEvents:$ThreatPreventionEvents ",
26561
+ "responseStr": "threatPreventionsEvents:$threatPreventionEvents ",
26562
26562
  "type": {
26563
26563
  "definition": {
26564
26564
  "description": null,
@@ -27060,10 +27060,10 @@
27060
27060
  "name": "ThreatPreventionEvents",
27061
27061
  "non_null": false
27062
27062
  },
27063
- "varName": "ThreatPreventionEvents"
27063
+ "varName": "threatPreventionEvents"
27064
27064
  },
27065
27065
  "ticket": {
27066
- "alias": "ThreatPreventionTicket: ticket",
27066
+ "alias": "threatPreventionTicket: ticket",
27067
27067
  "args": {},
27068
27068
  "deprecationReason": null,
27069
27069
  "description": null,
@@ -27091,9 +27091,9 @@
27091
27091
  "isDeprecated": false,
27092
27092
  "name": "timeSeries",
27093
27093
  "path": "story.incident.ThreatPrevention.timeSeries",
27094
- "requestStr": "$IncidentTimeseries:[IncidentTimeseries] ",
27094
+ "requestStr": "$incidentTimeseries:[IncidentTimeseries] ",
27095
27095
  "required": false,
27096
- "responseStr": "timeSeries:$IncidentTimeseries ",
27096
+ "responseStr": "timeSeries:$incidentTimeseries ",
27097
27097
  "type": {
27098
27098
  "definition": {
27099
27099
  "description": null,
@@ -27164,7 +27164,7 @@
27164
27164
  "varName": "info"
27165
27165
  },
27166
27166
  "key": {
27167
- "alias": "TimeseriesKeyKey: key",
27167
+ "alias": "timeseriesKeyKey: key",
27168
27168
  "args": {},
27169
27169
  "deprecationReason": null,
27170
27170
  "description": null,
@@ -27172,9 +27172,9 @@
27172
27172
  "isDeprecated": false,
27173
27173
  "name": "key",
27174
27174
  "path": "story.incident.ThreatPrevention.timeSeries.key",
27175
- "requestStr": "$TimeseriesKey:TimeseriesKey ",
27175
+ "requestStr": "$timeseriesKey:TimeseriesKey ",
27176
27176
  "required": false,
27177
- "responseStr": "key:$TimeseriesKey ",
27177
+ "responseStr": "key:$timeseriesKey ",
27178
27178
  "type": {
27179
27179
  "definition": {
27180
27180
  "description": null,
@@ -27188,9 +27188,9 @@
27188
27188
  "isDeprecated": false,
27189
27189
  "name": "dimensions",
27190
27190
  "path": "story.incident.ThreatPrevention.timeSeries.key.dimensions",
27191
- "requestStr": "$DimensionKey:[DimensionKey] ",
27191
+ "requestStr": "$dimensionKey:[DimensionKey] ",
27192
27192
  "required": false,
27193
- "responseStr": "dimensions:$DimensionKey ",
27193
+ "responseStr": "dimensions:$dimensionKey ",
27194
27194
  "type": {
27195
27195
  "definition": {
27196
27196
  "description": null,
@@ -27253,7 +27253,7 @@
27253
27253
  "name": "DimensionKey",
27254
27254
  "non_null": false
27255
27255
  },
27256
- "varName": "DimensionKey"
27256
+ "varName": "dimensionKey"
27257
27257
  },
27258
27258
  "measureFieldName": {
27259
27259
  "args": {},
@@ -27290,7 +27290,7 @@
27290
27290
  "name": "TimeseriesKey",
27291
27291
  "non_null": false
27292
27292
  },
27293
- "varName": "TimeseriesKey"
27293
+ "varName": "timeseriesKey"
27294
27294
  },
27295
27295
  "label": {
27296
27296
  "args": {},
@@ -27334,7 +27334,7 @@
27334
27334
  "varName": "sum"
27335
27335
  },
27336
27336
  "units": {
27337
- "alias": "UnitTypeUnits: units",
27337
+ "alias": "unitTypeUnits: units",
27338
27338
  "args": {},
27339
27339
  "deprecationReason": null,
27340
27340
  "description": "Identifies what unit of data this timeseries represents. Note that toRate is only available for particular types\nof data to make sense.",
@@ -27448,10 +27448,10 @@
27448
27448
  "name": "IncidentTimeseries",
27449
27449
  "non_null": false
27450
27450
  },
27451
- "varName": "IncidentTimeseries"
27451
+ "varName": "incidentTimeseries"
27452
27452
  },
27453
27453
  "user": {
27454
- "alias": "UserRef: user",
27454
+ "alias": "userRef: user",
27455
27455
  "args": {},
27456
27456
  "deprecationReason": null,
27457
27457
  "description": null,
@@ -27459,9 +27459,9 @@
27459
27459
  "isDeprecated": false,
27460
27460
  "name": "user",
27461
27461
  "path": "story.incident.ThreatPrevention.user",
27462
- "requestStr": "$UserRef:UserRef ",
27462
+ "requestStr": "$userRef:UserRef ",
27463
27463
  "required": false,
27464
- "responseStr": "user:$UserRef ",
27464
+ "responseStr": "user:$userRef ",
27465
27465
  "type": {
27466
27466
  "definition": {
27467
27467
  "description": null,
@@ -27523,10 +27523,10 @@
27523
27523
  "name": "UserRef",
27524
27524
  "non_null": false
27525
27525
  },
27526
- "varName": "UserRef"
27526
+ "varName": "userRef"
27527
27527
  },
27528
27528
  "vendor": {
27529
- "alias": "ThreatPreventionVendor: vendor",
27529
+ "alias": "threatPreventionVendor: vendor",
27530
27530
  "args": {},
27531
27531
  "deprecationReason": null,
27532
27532
  "description": null,
@@ -27587,7 +27587,7 @@
27587
27587
  "name": "MergedIncident",
27588
27588
  "non_null": false
27589
27589
  },
27590
- "varName": "MergedIncident"
27590
+ "varName": "mergedIncident"
27591
27591
  },
27592
27592
  "playbook": {
27593
27593
  "args": {},
@@ -27637,9 +27637,9 @@
27637
27637
  "isDeprecated": false,
27638
27638
  "name": "timeline",
27639
27639
  "path": "story.timeline",
27640
- "requestStr": "$TimelineItem:[TimelineItem]! ",
27640
+ "requestStr": "$timelineItem:[TimelineItem]! ",
27641
27641
  "required": true,
27642
- "responseStr": "timeline:$TimelineItem ",
27642
+ "responseStr": "timeline:$timelineItem ",
27643
27643
  "type": {
27644
27644
  "definition": {
27645
27645
  "description": null,
@@ -27666,7 +27666,7 @@
27666
27666
  "varName": "additionalInfo"
27667
27667
  },
27668
27668
  "analystInfo": {
27669
- "alias": "AnalystInfoAnalystInfo: analystInfo",
27669
+ "alias": "analystInfoAnalystInfo: analystInfo",
27670
27670
  "args": {},
27671
27671
  "deprecationReason": null,
27672
27672
  "description": "Data about the analyst for this timeline item (ie. name, email)",
@@ -27674,9 +27674,9 @@
27674
27674
  "isDeprecated": false,
27675
27675
  "name": "analystInfo",
27676
27676
  "path": "story.timeline.analystInfo",
27677
- "requestStr": "$AnalystInfo:AnalystInfo ",
27677
+ "requestStr": "$analystInfo:AnalystInfo ",
27678
27678
  "required": false,
27679
- "responseStr": "analystInfo:$AnalystInfo ",
27679
+ "responseStr": "analystInfo:$analystInfo ",
27680
27680
  "type": {
27681
27681
  "definition": {
27682
27682
  "description": null,
@@ -27736,10 +27736,10 @@
27736
27736
  "name": "AnalystInfo",
27737
27737
  "non_null": false
27738
27738
  },
27739
- "varName": "AnalystInfo"
27739
+ "varName": "analystInfo"
27740
27740
  },
27741
27741
  "category": {
27742
- "alias": "TimelineItemCategoryEnumCategory: category",
27742
+ "alias": "timelineItemCategoryEnumCategory: category",
27743
27743
  "args": {},
27744
27744
  "deprecationReason": null,
27745
27745
  "description": "Enum for the timeline category (ie. Information, Warning, Error)",
@@ -27876,7 +27876,7 @@
27876
27876
  "varName": "descriptions"
27877
27877
  },
27878
27878
  "type": {
27879
- "alias": "TimelineTypeEnumType: type",
27879
+ "alias": "timelineTypeEnumType: type",
27880
27880
  "args": {},
27881
27881
  "deprecationReason": null,
27882
27882
  "description": "Enum for the type (ie. Diff, Action, Comment)",
@@ -27944,7 +27944,7 @@
27944
27944
  "name": "TimelineItem",
27945
27945
  "non_null": false
27946
27946
  },
27947
- "varName": "TimelineItem"
27947
+ "varName": "timelineItem"
27948
27948
  },
27949
27949
  "updatedAt": {
27950
27950
  "args": {},
@@ -27981,7 +27981,7 @@
27981
27981
  "name": "Story",
27982
27982
  "non_null": false
27983
27983
  },
27984
- "varName": "Story"
27984
+ "varName": "story"
27985
27985
  }
27986
27986
  },
27987
27987
  "inputFields": null,