Skip to main content

Group by Policy field

POST 
/alert/v1/aggregate

Return paginated groups with alert count based on the group by policy field, input filter along with next pagination token

Request​

Body

required
    filters object[]

    Filtering parameters

  • Array [
    • name string
    value string
    operator string
  • ]
    • sortBy string[]

    Array of sort properties. Append :asc or :desc to the key to sort by ascending or descending order respectively. Example sort properties are id:asc and timestamp:desc

    groupBy string

    Possible values: [policy.type, policy.severity, policy.label, compliance.standard]

    group by field

    size int32

    Maximum number of items to return. When data is paginated, maximum number of items per page.The maximum cannot exceed 500. The default is 50

    nextPageToken string

    Setting this pagination Token to the nextPageToken from a response object returns the next page of data

    timeRange object
    oneOf
    Time type string

    Possible values: [to_now,absolute,relative,from_now]

    type for time range

    Time value object

    Possible values: [epoch]

    Field for range string

    Possible values: [lastOpenStateTs, lastStatusChangeTs, lastUpdatedTs]

    type stringrequired
    value object
    startTime int64
    endTime int64

Responses​

Successful operation

Schema
    groups object[]
  • Array [
    • group string

    group by field, for example : policy type, compliance standard etc

    totalAlerts int64

    sum of all alert count for all policies in the group

    totalPolicies int32

    number of policies in the group

    criticalAlertCount int64

    alert count for policies with critical severity in the group

    highAlertCount int64

    alert count for policies with high severity in the group

    mediumAlertCount int64

    alert count for policies with medium severity in the group

    lowAlertCount int64

    alert count for policies with low severity in the group

    informationalAlertCount int64

    alert count for policies with informational severity in the group

    buildPolicyCount int64

    number of build policy

    runPolicyCount int64

    number of run policy

    findingTypes string[]

    List of finding types

    cloudTypes string[]

    Possible values: [all, aws, azure, gcp, alibaba_cloud, oci, other, ibm]

    List of cloud types

    policyIds string[]

    List of policy ids

  • ]
    • groupBy string
    countDetails object
    totalAlerts int64

    alert count

    totalPolicies int32

    policy count

    nextPageToken string
Loading...