catocli 3.0.26__py3-none-any.whl → 3.0.29__py3-none-any.whl

catocli/parsers/query_appStatsTimeSeries/README.md

@@ -41,7 +41,12 @@ catocli query appStatsTimeSeries '{
 ## Advanced Usage
 ### Additional Examples
 - Query to export upstream, downstream and traffic for user_name and application_name for last day broken into 1 hour buckets
-- Query to export WANBOUND traffic including upstream, downstream and traffic for user_name and application_name for last day broken into 1 hour buckets
+- Traffic patterns throughout the day
+- Wanbound traffic with hourly breakdown
+- Usage patterns over a full week
+- 5-minute intervals for detailed monitoring
+- Business hours with 15-minute granularity
+- User activity patterns with application usage
 
 # Query to export upstream, downstream and traffic for user_name and application_name for last day broken into 1 hour buckets
 
@@ -74,51 +79,130 @@ catocli query appStatsTimeSeries '{
         }
     ],
     "timeFrame": "last.P1D"
-}'
+}' -f csv --csv-filename=appStatsTimeSeries_app_bw.csv
 ```
 
-# Query to export WANBOUND traffic including upstream, downstream and traffic for user_name and application_name for last day broken into 1 hour buckets
+
+# Traffic patterns throughout the day
 
 ```bash
-# Query to export WANBOUND traffic including upstream, downstream and traffic for user_name and application_name for last day broken into 1 hour buckets
+# Traffic patterns throughout the day
+catocli query appStatsTimeSeries '{
+    "buckets": 24,
+    "dimension": [
+        {"fieldName": "user_name"},
+        {"fieldName": "application_name"}
+    ],
+    "perSecond": false,
+    "measure": [
+        {"aggType": "sum", "fieldName": "upstream"},
+        {"aggType": "sum", "fieldName": "downstream"},
+        {"aggType": "sum", "fieldName": "traffic"}
+    ],
+    "timeFrame": "last.P1D"
+}' -f csv --csv-filename=appStatsTimeSeries_user_app.csv
+```
+
+# Wanbound traffic with hourly breakdown
+
+```bash
+# Wanbound traffic with hourly breakdown
 catocli query appStatsTimeSeries '{
     "appStatsFilter": [
         {
             "fieldName": "traffic_direction",
             "operator": "is",
-            "values": [
-                "WANBOUND"
-            ]
+            "values": ["WANBOUND"]
         }
     ],
     "buckets": 24,
     "dimension": [
-        {
-            "fieldName": "application_name"
-        },
-        {
-            "fieldName": "user_name"
-        }
+        {"fieldName": "application_name"},
+        {"fieldName": "user_name"}
     ],
     "perSecond": false,
     "measure": [
-        {
-            "aggType": "sum",
-            "fieldName": "traffic"
-        },
-        {
-            "aggType": "sum",
-            "fieldName": "upstream"
-        },
-        {
-            "aggType": "sum",
-            "fieldName": "downstream"
-        }
+        {"aggType": "sum", "fieldName": "traffic"},
+        {"aggType": "sum", "fieldName": "upstream"},
+        {"aggType": "sum", "fieldName": "downstream"}
     ],
     "timeFrame": "last.P1D"
-}'
+}' -f csv --csv-filename=appStatsTimeSeries_user_wan.csv
+```
+
+# Usage patterns over a full week
+
+```bash
+# Usage patterns over a full week
+catocli query appStatsTimeSeries '{
+    "buckets": 168,
+    "dimension": [
+        {"fieldName": "category"},
+        {"fieldName": "src_site_name"}
+    ],
+    "perSecond": false,
+    "measure": [
+        {"aggType": "sum", "fieldName": "traffic"},
+        {"aggType": "sum", "fieldName": "flows_created"}
+    ],
+    "timeFrame": "last.P7D"
+}' -f csv --csv-filename appStatsTimeSeries_weekly_usage_category.csv
 ```
 
+# 5-minute intervals for detailed monitoring
+
+```bash
+# 5-minute intervals for detailed monitoring
+catocli query appStatsTimeSeries '{
+    "buckets": 72,
+    "dimension": [
+        {"fieldName": "user_name"}
+    ],
+    "perSecond": false,
+    "measure": [
+        {"aggType": "sum", "fieldName": "traffic"}
+    ],
+    "timeFrame": "last.PT6H"
+}' -f csv --csv-filename appStatsTimeSeries_high_resolution_user.csv
+```
+
+# Business hours with 15-minute granularity
+
+```bash
+# Business hours with 15-minute granularity
+catocli query appStatsTimeSeries '{
+    "buckets": 32,
+    "dimension": [
+        {"fieldName": "application_name"}
+    ],
+    "perSecond": false,
+    "measure": [
+        {"aggType": "sum", "fieldName": "traffic"},
+        {"aggType": "sum", "fieldName": "flows_created"}
+    ],
+    "timeFrame": "utc.2025-10-{15/08:00:00--15/16:00:00}"
+}' -f csv --csv-filename appStatsTimeSeries_bus_hours.csv
+```
+
+# User activity patterns with application usage
+
+```bash
+# User activity patterns with application usage
+catocli query appStatsTimeSeries '{
+    "buckets": 48,
+    "dimension": [
+        {"fieldName": "user_name"},
+        {"fieldName": "categories"}
+    ],
+    "perSecond": false,
+    "measure": [
+        {"aggType": "sum", "fieldName": "flows_created"}
+    ],
+    "timeFrame": "last.P2D"
+}' -f csv --csv-filename appStatsTimeSeries_user_by_category.csv
+```
+
+
 
 
 #### TimeFrame Parameter Examples

catocli/parsers/query_eventsTimeSeries/README.md

@@ -42,15 +42,13 @@ catocli query eventsTimeSeries '{
 ### Additional Examples
 - Weekly break down by hour of Internet Firewall events by rule_name
 - Weekly hourly breakdown by hour of sum of site events
-- 1 hour in 5 min increments of sum of site events used for detecting throttling
-- Basic Event Count Query with enhanced formatting
-- Basic Event Count Query - Returns formatted JSON with granularity-adjusted values
+- 1 hour 5 min increment of sum of site events used for detecting throttling
+- 1 hour 5 min increments of sum of site events used for detecting throttling
+- Basic event count - weekly hourly
 - Security Events Analysis
 - Security Events Analysis - Daily breakdown of security events
 - Connectivity Events by Country
 - Connectivity Events by Country - Weekly breakdown with country dimensions
-- Threat Analysis with Trend
-- Threat Analysis with Trend - Monthly threat score analysis
 - Socket Connectivity Analysis
 - Socket Connectivity Analysis - Connection events by socket interface
 
@@ -80,15 +78,16 @@ catocli query eventsTimeSeries '{
             "fieldName": "event_count"
         }
     ],
-    "timeFrame": "last.P7D"
-}'
+    "perSecond": false,
+    "timeFrame": "last.P1D"
+}' -f csv --csv-filename=eventsTimeSeries_by_subType.csv
 ```
 
 # Weekly hourly breakdown by hour of sum of site events
 
 ```bash
 # Weekly hourly breakdown by hour of sum of site events
-catocli query eventsTimeSeries -accountID=15412 '{
+catocli query eventsTimeSeries '{
     "buckets": 168,
     "eventsDimension": [],
     "eventsFilter": [
@@ -106,17 +105,18 @@ catocli query eventsTimeSeries -accountID=15412 '{
             "fieldName": "event_count"
         }
     ],
+    "perSecond": false,
     "timeFrame": "last.P7D"
-}'
+}' -f csv --csv-filename=eventsTimeSeries_hourly_site_events.csv
 ```
 
 
-# 1 hour in 5 min increments of sum of site events used for detecting throttling
+# 1 hour 5 min increment of sum of site events used for detecting throttling
 
 ```bash
-# 1 hour in 5 min increments of sum of site events used for detecting throttling
-catocli query eventsTimeSeries -accountID=15412 '{
-    "buckets": 12,
+# 1 hour 5 min increments of sum of site events used for detecting throttling
+catocli query eventsTimeSeries '{
+    "buckets": 168,
     "eventsDimension": [],
     "eventsFilter": [
         {
@@ -133,20 +133,22 @@ catocli query eventsTimeSeries -accountID=15412 '{
             "fieldName": "event_count"
         }
     ],
+    "perSecond": false,
     "timeFrame": "last.P1D"
-}'
+}' -f csv --csv-filename=eventsTimeSeries_15_min_site_events.csv
 ```
 
-
-
-
-# Basic Event Count Query with enhanced formatting
+# Basic event count - weekly hourly
 
 ```bash
-# Basic Event Count Query - Returns formatted JSON with granularity-adjusted values
+# Basic event count - weekly hourly
 catocli query eventsTimeSeries '{
-    "buckets": 4,
-    "eventsDimension": [],
+    "buckets": 168,
+    "eventsDimension": [
+        {
+            "fieldName": "rule_name"
+        }
+    ],
     "eventsFilter": [],
     "eventsMeasure": [
         {
@@ -154,8 +156,9 @@ catocli query eventsTimeSeries '{
             "fieldName": "event_count"
         }
     ],
-    "timeFrame": "utc.2023-02-{28/00:00:00--28/23:59:59}"
-}'
+    "perSecond": false,
+    "timeFrame": "last.P7D"
+}' -f csv --csv-filename=eventsTimeSeries_weekly_hourly_events.csv
 ```
 
 # Security Events Analysis
@@ -178,8 +181,9 @@ catocli query eventsTimeSeries '{
             "fieldName": "event_count"
         }
     ],
-    "timeFrame": "utc.2023-02-{28/00:00:00--28/23:59:59}"
-}'
+    "perSecond": false,
+    "timeFrame": "last.P1D"
+}' -f csv --csv-filename=eventsTimeSeries_daily_security_events.csv
 ```
 
 # Connectivity Events by Country
@@ -206,37 +210,9 @@ catocli query eventsTimeSeries '{
             "fieldName": "event_count"
         }
     ],
-    "timeFrame": "utc.2023-03-{01/00:00:00--07/23:59:59}"
-}'
-```
-
-# Threat Analysis with Trend
-
-```bash
-# Threat Analysis with Trend - Monthly threat score analysis
-catocli query eventsTimeSeries '{
-    "buckets": 31,
-    "eventsDimension": [],
-    "eventsFilter": [
-        {
-            "fieldName": "event_type",
-            "operator": "is",
-            "values": ["Security"]
-        },
-        {
-            "fieldName": "threat_score",
-            "operator": "gt",
-            "values": ["50"]
-        }
-    ],
-    "eventsMeasure": [
-        {
-            "aggType": "avg",
-            "fieldName": "threat_score"
-        }
-    ],
-    "timeFrame": "utc.2023-01-{01/00:00:00--31/23:59:59}"
-}'
+    "perSecond": false,
+    "timeFrame": "last.P1D"
+}' -f csv --csv-filename=eventsTimeSeries_weekly_daily_by_country.csv
 ```
 
 # Socket Connectivity Analysis
@@ -244,7 +220,7 @@ catocli query eventsTimeSeries '{
 ```bash
 # Socket Connectivity Analysis - Connection events by socket interface
 catocli query eventsTimeSeries '{
-    "buckets": 28,
+    "buckets": 7,
     "eventsDimension": [
         {
             "fieldName": "socket_interface"
@@ -268,8 +244,9 @@ catocli query eventsTimeSeries '{
             "fieldName": "event_count"
         }
     ],
-    "timeFrame": "utc.2023-02-{01/00:00:00--28/23:59:59}"
-}'
+    "perSecond": false,
+    "timeFrame": "last.P7D"
+}' -f csv --csv-filename=eventsTimeSeries_daily_socket_connect.csv
 ```
 
 ## Output Format Options

catocli/parsers/query_socketPortMetrics/README.md

@@ -43,6 +43,8 @@ catocli query socketPortMetrics '{
 ## Advanced Usage
 ### Additional Examples
 - 1 Day sum of traffic by site, socket_interface, device_id
+- Traffic patterns by site and interface
+- Traffic distribution across devices
 
 # 1 Day sum of traffic by site, socket_interface, device_id
 
@@ -83,6 +85,68 @@ catocli query socketPortMetrics '{
 }'
 ```
 
+# Traffic patterns by site and interface
+
+```bash
+# Traffic patterns by site and interface
+catocli query socketPortMetrics '{
+    "socketPortMetricsDimension": [
+        {"fieldName": "socket_interface"},
+        {"fieldName": "device_id"},
+        {"fieldName": "site_id"},
+        {"fieldName": "site_name"}
+    ],
+    "socketPortMetricsMeasure": [
+        {"aggType": "sum", "fieldName": "bytes_upstream"},
+        {"aggType": "sum", "fieldName": "bytes_downstream"},
+        {"aggType": "sum", "fieldName": "bytes_total"}
+    ],
+    "socketPortMetricsSort": [
+        {"fieldName": "bytes_total", "order": "desc"}
+    ],
+    "timeFrame": "last.P1D"
+}' -f csv --csv-filename socketPortMetrics_traffic_by_site_interface.csv
+```
+
+# Traffic distribution across devices
+
+```bash
+# Traffic distribution across devices
+catocli query socketPortMetrics '{
+    "socketPortMetricsDimension": [
+        {
+            "fieldName": "device_id"
+        },
+        {
+            "fieldName": "site_name"
+        }
+    ],
+    "socketPortMetricsFilter": [],
+    "socketPortMetricsMeasure": [
+        {
+            "aggType": "sum",
+            "fieldName": "bytes_total"
+        },
+        {
+            "aggType": "avg",
+            "fieldName": "throughput_downstream"
+        },
+        {
+            "aggType": "avg",
+            "fieldName": "throughput_upstream"
+        }
+    ],
+    "socketPortMetricsSort": [
+        {
+            "fieldName": "bytes_total",
+            "order": "desc"
+        }
+    ],
+    "timeFrame": "last.P1D"
+}' -f csv --csv-filename socketPortMetrics_site_bw_by_device.csv
+```
+
+
 
 
 #### TimeFrame Parameter Examples

catocli/parsers/query_socketPortMetricsTimeSeries/README.md

@@ -42,6 +42,17 @@ catocli query socketPortMetricsTimeSeries '{
 ### Additional Examples
 - 1 Day sum of traffic by site, socket_interface, device_id
 - 1 Day sum of traffic by site, socket_interface, device_id as csv
+- Interface traffic patterns throughout the day
+- Weekly average utilization patterns
+- Throughput trends over extended periods
+- Peak traffic hours with high-resolution monitoring
+- Multi-Site Performance Comparison
+- Performance during specific business hours
+- Traffic patterns between weekdays and weekends
+- Weekend analysis
+- Analyze month-over-month growth trends
+- High-level metrics for executive reporting
+- High-level metrics for executive reporting - daily summary
 
 # 1 Day sum of traffic by site, socket_interface, device_id
 
@@ -82,43 +93,191 @@ catocli query socketPortMetricsTimeSeries
 }' -f csv
 ```
 
-# 1 Day sum of traffic by site, socket_interface, device_id
+# Interface traffic patterns throughout the day
 
 ```bash
-# 1 Day sum of traffic by site, socket_interface, device_id
+# Interface traffic patterns throughout the day
 catocli query socketPortMetricsTimeSeries '{
-    "buckets": 120,
+    "buckets": 24,
     "socketPortMetricsDimension": [
-        {
-            "fieldName": "socket_interface"
-        },
-        {
-            "fieldName": "device_id"
-        },
-        {
-            "fieldName": "site_id"
-        },
-        {
-            "fieldName": "site_name"
-        }
+        {"fieldName": "socket_interface"},
+        {"fieldName": "site_name"}
+    ],
+    "socketPortMetricsMeasure": [
+        {"aggType": "sum", "fieldName": "bytes_downstream"},
+        {"aggType": "sum", "fieldName": "bytes_upstream"},
+        {"aggType": "sum", "fieldName": "bytes_total"}
+    ],
+    "perSecond": false,
+    "timeFrame": "last.P1D"
+}' -f csv --csv-filename socketPortMetricsTimeSeries_daily_traffic_patterns.csv
+```
+
+# Weekly average utilization patterns
+
+```bash
+# Weekly average utilization patterns
+catocli query socketPortMetricsTimeSeries '{
+    "buckets": 24,
+    "perSecond": false,
+    "socketPortMetricsDimension": [
+        { "fieldName": "site_name" }
     ],
     "socketPortMetricsFilter": [],
     "socketPortMetricsMeasure": [
         {
-            "aggType": "sum",
+            "aggType": "avg",
             "fieldName": "throughput_downstream"
         },
         {
-            "aggType": "sum",
+            "aggType": "avg",
             "fieldName": "throughput_upstream"
         }
     ],
+    "timeFrame": "last.P1D"
+}' -f csv --csv-filename socketPortMetricsTimeSeries_weekly_bw_analysis.csv
+```
+
+# Throughput trends over extended periods
+
+```bash
+# Throughput trends over extended periods
+catocli query socketPortMetricsTimeSeries '{
+    "buckets": 120,
+    "socketPortMetricsDimension": [
+        {"fieldName": "socket_interface"},
+        {"fieldName": "device_id"},
+        {"fieldName": "site_name"}
+    ],
+    "socketPortMetricsMeasure": [
+        {"aggType": "sum", "fieldName": "throughput_downstream"},
+        {"aggType": "sum", "fieldName": "throughput_upstream"}
+    ],
+    "perSecond": false,
     "timeFrame": "last.P2M"
-}'
+}' -f csv --csv-filename socketPortMetricsTimeSeries_longterm_throughput_trends.csv
 ```
 
+# Peak traffic hours with high-resolution monitoring
 
+```bash
+# Peak traffic hours with high-resolution monitoring
+catocli query socketPortMetricsTimeSeries '{
+    "buckets": 96,
+    "socketPortMetricsDimension": [
+        {"fieldName": "socket_interface"}
+    ],
+    "socketPortMetricsMeasure": [
+        {"aggType": "sum", "fieldName": "bytes_total"}
+    ],
+    "perSecond": false,
+    "timeFrame": "last.P1D"
+}' -f csv --csv-filename socketPortMetricsTimeSeries_peak_hour_analysis.csv
+```
+
+# Multi-Site Performance Comparison
+
+```bash
+# Multi-Site Performance Comparison
+catocli query socketPortMetricsTimeSeries '{
+    "buckets": 48,
+    "socketPortMetricsDimension": [
+        {"fieldName": "site_name"},
+        {"fieldName": "socket_interface"}
+    ],
+    "socketPortMetricsMeasure": [
+        {"aggType": "sum", "fieldName": "throughput_downstream"},
+        {"aggType": "sum", "fieldName": "throughput_upstream"},
+        {"aggType": "sum", "fieldName": "bytes_total"}
+    ],
+    "perSecond": false,
+    "timeFrame": "last.P2D"
+}' -f csv --csv-filename socketPortMetricsTimeSeries_multisite_performance.csv
+```
+
+# Performance during specific business hours
+
+```bash
+# Performance during specific business hours
+catocli query socketPortMetricsTimeSeries '{
+    "buckets": 24,
+    "perSecond": false,
+    "socketPortMetricsDimension": [
+        { "fieldName": "site_name" },
+        { "fieldName": "socket_interface" }
+    ],
+    "socketPortMetricsFilter": [],
+    "socketPortMetricsMeasure": [
+        { "aggType": "avg", "fieldName": "bytes_upstream" },
+        { "aggType": "avg", "fieldName": "bytes_total" },
+        { "aggType": "avg", "fieldName": "bytes_downstream" }
+    ],
+    "perSecond": false,
+    "timeFrame": "last.P1D"
+}' -f csv --csv-filename socketPortMetricsTimeSeries_business_hours_utilization.csv
+```
+
+# Traffic patterns between weekdays and weekends
 
+```bash
+# Traffic patterns between weekdays and weekends
+catocli query socketPortMetricsTimeSeries '{
+    "buckets": 120,
+    "socketPortMetricsDimension": [{"fieldName": "site_name"}],
+    "socketPortMetricsMeasure": [{"aggType": "sum", "fieldName": "bytes_total"}],
+    "perSecond": false,
+    "timeFrame": "utc.2025-10-{13/00:00:00--17/23:59:59}"
+}' -f csv --csv-filename socketPortMetricsTimeSeries_weekday_traffic.csv
+
+# Weekend analysis  
+catocli query socketPortMetricsTimeSeries '{
+    "buckets": 48,
+    "socketPortMetricsDimension": [{"fieldName": "site_name"}],
+    "socketPortMetricsMeasure": [{"aggType": "sum", "fieldName": "bytes_total"}],
+    "timeFrame": "utc.2025-10-{18/00:00:00--19/23:59:59}"
+}' -f csv --csv-filename socketPortMetricsTimeSeries_weekend_traffic.csv
+```
+
+# Analyze month-over-month growth trends
+
+```bash
+# Analyze month-over-month growth trends
+catocli query socketPortMetricsTimeSeries '{
+    "buckets": 30,
+    "socketPortMetricsDimension": [
+        {"fieldName": "site_name"}
+    ],
+    "socketPortMetricsMeasure": [
+        { "aggType": "avg", "fieldName": "bytes_upstream" },
+        { "aggType": "avg", "fieldName": "bytes_total" },
+        { "aggType": "avg", "fieldName": "bytes_downstream" }
+    ],
+    "perSecond": false,
+    "timeFrame": "last.P1M"
+}' -f csv --csv-filename socketPortMetricsTimeSeries_monthly_growth_trends.csv
+```
+
+# High-level metrics for executive reporting
+
+```bash
+# High-level metrics for executive reporting - daily summary
+catocli query socketPortMetricsTimeSeries '{
+    "buckets": 7,
+    "socketPortMetricsDimension": [
+        {"fieldName": "socket_interface"},
+        {"fieldName": "site_name"}
+    ],
+    "socketPortMetricsMeasure": [
+        { "aggType": "sum", "fieldName": "bytes_upstream" },
+        { "aggType": "sum", "fieldName": "bytes_total" },
+        { "aggType": "sum", "fieldName": "bytes_downstream" },
+        { "aggType": "avg", "fieldName": "throughput_downstream" },
+        { "aggType": "avg", "fieldName": "throughput_upstream" }
+    ],
+    "perSecond": false,
+    "timeFrame": "last.P7D"
+}' -f csv --csv-filename socketPortMetricsTimeSeries_executive_dashboard.csv --append-timestamp
+```