swagger: '2.0'
info:
  contact:
    email: support@vectra.ai
  description: |
    ## Overview

    A REST API is available for administrators and developers to integrate
    Vectra's breach detection data into their applications.
    Vectra RESTful API provides access to security event data, platform configuration,
     and health information via URI paths.

    Vectra REST API is based on open standards.
    You can use any web development language to access
     and retrieve information via the API. A common use-case would be to retrieve security event information
     generated by the Vectra platform and supply this information to a security operations dashboard or
     incident response and ticketing systems.

    The REST API can be accessed via HTTPS connection to the interface IP address of the Vectra brain.
     The data in the response to the API query is in JSON format.

    Examples of security event data that can be integrated into your application:

      * Security event type detected
      * Account information associated with the security event
      * Severity of the Account activities

    The Vectra REST API is accessible using OAuth2 authentication.

    ## Security Detection Data

    The "Detections" and "Accounts" elements retrieve security events that can be inserted into external
    applications. The REST API provides filtering options to extract data. Advanced parsing of the data can
    be performed after data has been retrieved and saved into your target application. Order of the response
    data returned is latest first.
  license:
    name: Proprietary
  termsOfService: https://www.google.com/policies/terms/
  title: REST API Documentation
  version: v3.4
servers:
- url: https://{apiBaseUrl}/
  variables:
    apiBaseUrl:
      default: VECTRA_PORTAL_URL
      description: The FQDN or IP for the specific Vectra tenant you want to use for
        testing.
basePath: /api
consumes:
- application/json
produces:
- application/json
schemes:
- https
security:
- OAuth2: []
securityDefinitions:
  Basic:
    type: basic
  OAuth2:
    authorizationUrl: https://VECTRA_PORTAL_URL/oauth2/token
    flow: application
    scopes:
      read: Grants read access
    tokenUrl: https://VECTRA_PORTAL_URL/oauth2/token
    type: oauth2
paths:
  /oauth2/token:
    post:
      summary: Create Oauth2 Token
      consumes:
      - application/x-www-form-urlencoded
      description:
        Endpoint for retrieving authentication token

        Refer to the Resource tab for more information
        on authentication.
      operationId: oauth2_token
      parameters:
      - default: client_credentials
        description: The authorization grant used to obtain a new access token.
        enum:
        - refresh_token
        - client_credentials
        in: formData
        name: grant_type
        required: true
        example: client_credentials
      - name: refresh_token
        in: formData
        type: string
        x-nullable: true
        example: null
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400Ouath2'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
              - type: object
                title: Client credentials response
                description: The response for requests with client credentials as the grant type. 
                properties:
                  access_token:
                    type: string
                    description: Auth access token. 
                  expires_in:
                    type: integer
                    description: The seconds until the access token expires. 
                  refresh_expires_in:
                    type: integer
                    description: The seconds until the refresh token expires. 
                  refresh_token:
                    type: string
                    description: Auth refresh token.
                  token_type:
                    type: string
                    description: The token type, returns a value of Bearer. 
              - type: object
                title: Refresh token response
                description: The response for requests with refresh token as the grant type. 
                properties:
                  access_token:
                    type: string
                    description: Auth access token. 
                  expires_in:
                    type: integer
                    description: The seconds until the access token expires. 
                  token_type:
                    type: string
                    description: The token type, returns a value of Bearer. 
      security:
      - Basic: []
      tags:
      - auth
  /api/v3.4/accounts/:
    get:
      summary: Get Account List
      description: |
        Account objects contain information related to accounts observed in the environment.
      operationId: v3.4_accounts_list
      parameters:
        - $ref: '#/components/parameters/AccountsListParamsV3/ordering'
        - $ref: '#/components/parameters/AccountsListParamsV3/page'
        - $ref: '#/components/parameters/AccountsListParamsV3/page_size'
        - $ref: '#/components/parameters/AccountsListParamsV3/all'
        - $ref: '#/components/parameters/AccountsListParamsV3/c_score'
        - $ref: '#/components/parameters/AccountsListParamsV3/c_score_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/certainty'
        - $ref: '#/components/parameters/AccountsListParamsV3/certainty_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/exclude_fields'
        - $ref: '#/components/parameters/AccountsListParamsV3/fields'
        - $ref: '#/components/parameters/AccountsListParamsV3/first_seen'
        - $ref: '#/components/parameters/AccountsListParamsV3/id'
        - $ref: '#/components/parameters/AccountsListParamsV3/include_detection_summaries'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_detection_timestamp_lte'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_seen'
        - $ref: '#/components/parameters/AccountsListParamsV3/max_id'
        - $ref: '#/components/parameters/AccountsListParamsV3/min_id'
        - $ref: '#/components/parameters/AccountsListParamsV3/name'
        - $ref: '#/components/parameters/AccountsListParamsV3/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_category'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_level'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_level_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/state'
        - $ref: '#/components/parameters/AccountsListParamsV3/t_score'
        - $ref: '#/components/parameters/AccountsListParamsV3/t_score_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/tags'
        - $ref: '#/components/parameters/AccountsListParamsV3/threat'
        - $ref: '#/components/parameters/AccountsListParamsV3/threat_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/uid'

      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/AccountSerializerV3_4'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.4/accounts
    parameters: []
  /api/v3.4/accounts/{id}/:
    get:
      summary: Get Single Account
      description: |
        Account objects contain information related to accounts observed in the environment.
      operationId: v3.4_accounts_read
      parameters:
        - $ref: '#/components/parameters/AccountsReadParamsV3/exclude_fields'
        - $ref: '#/components/parameters/AccountsReadParamsV3/fields'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_access_history'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_detection_summaries'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_external'
        - $ref: '#/components/parameters/AccountsReadParamsV3/src_linked_account'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/SingleAccountSerializerV3_4'
      tags:
      - v3.4/accounts
    parameters:
    - in: path
      name: id
      required: true
      type: integer
  /api/v3.4/accounts/{id}/close:
    patch:
      summary: Close Single Account
      description: |
        Account objects contain information related to accounts observed in the environment.

        Closing an account indicates that some remedial action was taken based upon the account.
        Active detections associated with the account will be closed resulting in the detections no longer contributing to the scoring.
      parameters:
        - in: path
          name: id
          required: true
          type: integer
        - in: body
          name: data
          required: true
          schema:
            properties:
              reason:
                description: Reason for closing the account.
                type: string
                example: remediated
                enum:
                - remediated
                - benign
            type: object
      responses:
        '400':
          description: Bad request
          schema:
            oneOf:
              - $ref: '#/definitions/Error400MissingReasonParam'
              - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '422':
          description: Returned when request body is missing.
          schema:
            $ref: '#/definitions/Error422InvalidReason'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Returned when a detection has been closed'
          schema:
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success flag for patch.
                    example: Success
                  message:
                    type: object
                    properties:
                      reason:
                        type: string
                        description: Operation message
                        example: Successfully closed account as remediated
              detections_closed:
                type: array
                items:
                  type: integer
                  description: List of detection IDs that were closed.
                example: [1, 2, 3]
      tags:
      - v3.4/accounts    
  /api/v3.4/assignment_outcomes/:
    get:
      summary: Get Assignment Outcome List
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        This information includes but is not limited to:
          *	ID
          *	Title
          *	Category
      operationId: v3.4_assignment_outcomes_list
      parameters:
      - description: A page number within the paginated result set.
        in: query
        name: page
        required: false
        type: integer
        example: 1
        minimum: 1
      - description: Number of results to return per page.
        in: query
        name: page_size
        required: false
        type: integer
        minimum: 1
        example: 5
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/AssignmentOutcome'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.4/assignment_outcomes
    parameters: []
    post:
      summary: Create Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can create an outcome using this endpoint.
      operationId: v3.4_assignment_outcomes_create
      requestBody:
        $ref: '#/components/requestBodies/AssignmentOutcomePostBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignmentOutcomes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.4/assignment_outcomes
  /api/v3.4/assignment_outcomes/{id}/:
    delete:
      summary: Delete Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can delete an outcome using this endpoint.
      operationId: v3.4_assignment_outcomes_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400DeleteAssignmentOutcome'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.4/assignment_outcomes
    get:
      summary: Get Single Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        This information includes but is not limited to:
          *	ID
          *	Title
          *	Category
      operationId: v3.4_assignment_outcomes_read
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.4/assignment_outcomes
    parameters:
    - description: A unique integer value identifying this assignment outcome.
      in: path
      name: id
      required: true
      type: integer
      example: 1
      minimum: 1
    put:
      summary: Edit Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can modify an outcome using this endpoint.
      operationId: v3.4_assignment_outcomes_partial_update
      requestBody:
        $ref: '#/components/requestBodies/AssignmentOutcomePatchBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignmentOutcomes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.4/assignment_outcomes
  /api/v3.4/assignments/:
    get:
      summary: Get Assignment List
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.
        This information includes but is not limited to:
          * Assigned to user
          * Assigned by user
          * Date assigned
          * Date resolved
          * Events
          * Outcome
          * Account ID
          * Triaged detections
      operationId: v3.4_assignments_list
      parameters:
        - $ref: '#/components/parameters/AssignmentsListParamsV3/page'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/page_size'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/accounts'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/assignees'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/created_after'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/hosts'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/resolution'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/resolved'
      responses:
        '400':
          description: Invalid query parameter ,parameter value, or authorization error.
          schema:
           oneOf:
            - $ref: '#/definitions/Error400GetAssignments'
            - $ref: '#/definitions/Error400InvalidParams'
            - $ref: '#/definitions/Error400InvalidParamValue'
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/Assignment'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.4/assignments
    parameters: []
    post:
      summary: Create Assignment
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.
        The creation of assignments is handled by this endpoint.
      operationId: v3.4_assignments_create
      requestBody:
        $ref: '#/components/requestBodies/AssignmentPostBodyV3_3'
      responses:
        '400':
          description: "Invalid input error."
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignments'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.4/assignments
  /api/v3.4/assignments/{id}/:
    delete:
      summary: Delete Assignment
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.
        This endpoint handles deleting a single assignment. 
      operationId: v3.4_assignments_delete
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.4/assignments
    get:
      summary: Get Single Assignment
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.
        This information includes but is not limited to:
          * Assigned to user
          * Assigned by user
          * Date assigned
          * Date resolved
          * Events
          * Outcome
          * Account ID
          * Triaged detections
      operationId: v3.4_assignments_read
      responses:
        '400':
          description: 'Invalid query parameter.'
          schema:
            $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.4/assignments
    parameters:
      - $ref: "#/components/parameters/AssignmentsReadParamsV3/id"
    put:
      summary: Edit Assignment
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.

        An API client can modify the user and/or entity associated to an assignment using this endpoint.
      operationId: v3.4_assignments_update
      requestBody:
        $ref: '#/components/requestBodies/AssignmentPutBodyV3_3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: "Invalid input error."
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignments'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.4/assignments
  /api/v3.4/assignments/{id}/resolve/:
    parameters:
      - $ref: "#/components/parameters/AssignmentsReadParamsV3/id"
    put:
      summary: Resolve Assignment
      description: |
        Once completed, assignments can be resolved. Assignment resolutions provide a way to label and track
        the outcomes of assignments. Outcomes get recorded in the assignment's history.

        Outcome choices may include one of the following built-in assignment outcomes:
          * Benign True Positive
          * Malicious True Positive
          * False Positive

        Alternatively, users can choose to define their own Custom outcomes for reporting purposes.
      operationId: v3.4_assignments_resolve
      requestBody:
        $ref: '#/components/requestBodies/AssignmentsResolveBodyV3'
      responses:
        '409':
          description: 'Conflict error, assignment hsa already been resolved.'
          schema:
            $ref: '#/definitions/Error409ResolveAssignments'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: Invalid input error.
          schema:
            oneOf:
            - $ref: '#/definitions/Error400ResolveAssignmentsDetectionIDs'
            - $ref: '#/definitions/Error400ResolveAssignmentsOutcome'
            - $ref: '#/definitions/Error400ResolveAssignmentsTriageAs'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.4/assignments
  /api/v3.4/rules/:
    get:
      summary: Get Rule List
      tags:
      - v3.4/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint lists the existing Triage Rules in the system.
      operationId: v3.4_rules_list
      parameters:
        - $ref: '#/components/parameters/Common/ordering'
        - $ref: '#/components/parameters/Common/page'
        - $ref: '#/components/parameters/Common/page_size'
        - $ref: '#/components/parameters/RulesParamsV3/contains'
        - $ref: '#/components/parameters/RulesParamsV3/fields'
        - $ref: '#/components/parameters/RulesParamsV3/include_templates'
      responses:
        '404':
            description: The requested page does not exist. Reduce the requested page.
            schema:
              $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/RuleSerializerV3'
                type: array
    post:
      summary: Create Rule
      tags:
      - v3.4/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This path's POST method supports two different creation tasks
        depending on the request body.

        **Task A**

        When specifying a new triage category in the request body
        without a detection list, this endpoint creates new Triage Rules.

        The following format is required for source_conditions
        and additional_conditions in the request body:

        The format for Triage rules is based on AND/OR logic,
        making them more flexible and customizable to your specific situation.
        Both 'source_conditions' and 'additional_conditions' are now
        saved as JSON blobs which represents a tree-like structure.
        Each tree node is represented in the following format:

        ```
        {operator: operand}
        ```

        Where "operator" is any of the following:

        ```
        For non-leaf nodes: 'AND' or 'OR'
        For leaf nodes: 'ANY_OF' or 'NONE_OF'
        ```

        The format for "operand" also depends on the type of node.

        For non-leaf nodes, use a list of children tree nodes of the form:

        ```
        [{operator: operand}, {operator: operand}, ...]
        ```

        For leaf nodes, use a dictionary of the form:

        ```
        {
          'field': <FIELD NAME>,
          'values': [{'value': [<VALUE>]}],
          'group': [{'value': [<GROUP ID>]}]
        }
        ```

        Stipulations on the format of the top-level tree structure
        is that the top-level operator must be an 'OR' node, with
        a single 'AND' node as the only child. The 'AND' node may have an arbitrary number
        of leaf node children. All valid Triage rules will look as follows:

        ```
        {
          'OR': [
            {
              'AND': [
                <LEAF NODE 1>,
                <LEAF NODE 2>,
                ...
                <LEAF NODE N>,
              ]
            }
          ]
        }
        ```

        Note 'source_conditions' and 'additional_conditions' have different fields
        that can be used in their leaf nodes. For 'source_conditions', the following
        fields are valid: ip, host, account, sensor. The fields 'ip' and 'host'
        also support triaging on groups, meaning that an IP or a host leaf node can
        be given an IP Group or Host Group ID, and the Triage rule will apply to
        every IP/host in the specified group. For 'additional_conditions', the following
        fields are valid: remote1_ip, remote1_proto, remote1_port, remote1_dns, remote2_ip,
        remote2_proto, remote2_port, remote2_dns, account, named_pipe, uuid,
        identity, share, extensions, rdp client name, rdp client token, keyboard name.
        The fields 'remote1_ip', 'remote2_ip', 'remote1_dns', 'remote2_dns' support
        triaging on groups. Either 'source_conditions' or 'additional_conditions' may
        be null. Setting source_conditions to null implies that this Triage rule with
        apply to All Hosts.

        **Task B**

        The POST Triage Rules endpoint can be used with a
        request body specifying detection ids and a triage category
        to filter a set of detections under the chosen triage category
      operationId: v3.4_rules_create
      parameters:
      - in: body
        name: data
        required: true
        schema:
          oneOf:
          - title: Task A
            description: The request schema for Task A.
            $ref: '#/definitions/RuleRequestBodyV3'
          - type: object
            title: Task B
            description: The request schema for Task B.
            properties:
              detectionIdList:
                description: Detections ids to add to triage rule filter.
                items:
                  type: integer
                  example: 1
                type: array
              triage_category:
                type: string
                description: Custom Triage label used to categorize specified detections.
                example: Benign Detection
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400JsonParse'
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error422PostRulesInvalidField'
              - $ref: '#/definitions/Error422PostRulesConditionsField'
              - $ref: '#/definitions/Error422PostRulesDetectionList'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            oneOf:
            - type: object
              title: Task A
              description: The response for Task A.
              properties:
                id:
                  type: integer
                  description: Rule ID.
                  example: 1
                _meta:
                  type: object
                  properties:
                    level:
                      type: string
                      description: Success status of operation. 
                      example: Success
                    message:
                      type: string
                      description: Message of success status of operation. 
                      example: "Successfully created triage filter"
            - type: object
              title: Task B
              description: The response for Task B.
              properties:
                ids:
                  type: array
                  items:
                    type: integer
                    example: 1
                  description: Rule IDs. 
                _meta:
                  type: object
                  properties:
                    level:
                      type: string
                      description: Success status of operation. 
                      example: Success
                    message:
                      type: string
                      description: Message of success status of operation. 
                      example: "Successfully created triage filter"
    delete:
      summary: Delete Detections Rule
      tags:
      - v3.4/rules
      description: |
        The DELETE Triage Rules endpoint can be used with the following
        request body to remove triage filters for a set of detections.
      operationId: v3.4_detection_rules_delete
      parameters:
      - in: body
        name: data
        required: true
        schema:
          type: object
          properties:
            detectionIdList:
              description: Detections ids to remove triage rule filters.
              items:
                type: integer
                example: 1
              type: array
      responses:
        '422':
          description: Invalid input for detectionIdList.
          schema:
            $ref: '#/definitions/Error422DeleteRulesDetectionList'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
  /api/v3.4/rules/{rule_id}/:
    parameters:
    - in: path
      name: rule_id
      required: true
      type: integer
      description: The rule ID. 
    get:
      summary: Get Single Rule
      tags:
      - v3.4/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint lists a single Triage Rules in the system.
      operationId: v3_4_rule_read
      parameters:
      - description: Which field to use when ordering the results.
        in: query
        name: fields
        required: false
        type: string
        enum:
        - id
        - url
        - description
        - enabled
        - created_timestamp
        - last_timestamp
        - is_whitelist
        - priority
        - active_detections
        - total detections
        - template
        - additional_conditions
        - source_condition
        - detection
        - detection_category
        - triage_category
      responses:
        '400':
          description: Invalid query parameter requested.
          schema:
           $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/RuleSerializerV3'
    put:
      summary: Edit Rule
      tags:
      - v3.4/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint manages updating Triage Rules.

        The following format is required for source_conditions
        and additional_conditions in the request body:

        The format for Triage rules is based on AND/OR logic,
        making them more flexible and customizable to your specific situation.
        Both 'source_conditions' and 'additional_conditions' are now
        saved as JSON blobs which represents a tree-like structure.
        Each tree node is represented in the following format:

        ```
        {operator: operand}
        ```

        Where "operator" is any of the following:

        ```
        For non-leaf nodes: 'AND' or 'OR'
        For leaf nodes: 'ANY_OF' or 'NONE_OF'
        ```

        The format for "operand" also depends on the type of node.

        For non-leaf nodes, use a list of children tree nodes of the form:

        ```
        [{operator: operand}, {operator: operand}, ...]
        ```

        For leaf nodes, use a dictionary of the form:

        ```
        {
          'field': <FIELD NAME>,
          'values': [{'value': [<VALUE>]}],
          'group': [{'value': [<GROUP ID>]}]
        }
        ```

        Stipulations on the format of the top-level tree structure
        is that the top-level operator must be an 'OR' node, with
        a single 'AND' node as the only child. The 'AND' node may have an arbitrary number
        of leaf node children. All valid Triage rules will look as follows:

        ```
        {
          'OR': [
            {
              'AND': [
                <LEAF NODE 1>,
                <LEAF NODE 2>,
                ...
                <LEAF NODE N>,
              ]
            }
          ]
        }
        ```

        Note 'source_conditions' and 'additional_conditions' have different fields
        that can be used in their leaf nodes. For 'source_conditions', the following
        fields are valid: ip, host, account, sensor. The fields 'ip' and 'host'
        also support triaging on groups, meaning that an IP or a host leaf node can
        be given an IP Group or Host Group ID, and the Triage rule will apply to
        every IP/host in the specified group. For 'additional_conditions', the following
        fields are valid: remote1_ip, remote1_proto, remote1_port, remote1_dns, remote2_ip,
        remote2_proto, remote2_port, remote2_dns, account, named_pipe, uuid,
        identity, share, extensions, rdp client name, rdp client token, keyboard name.
        The fields 'remote1_ip', 'remote2_ip', 'remote1_dns', 'remote2_dns' support
        triaging on groups. Either 'source_conditions' or 'additional_conditions' may
        be null. Setting source_conditions to null implies that this Triage rule with
        apply to All Hosts.
      operationId: v3.4_rule_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          $ref: '#/definitions/RuleRequestBodyV3'
      responses:
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error422PostRulesInvalidField'
              - $ref: '#/definitions/Error422PostRulesConditionsField'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Rules'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              data:
                $ref: '#/definitions/RuleSerializerV3'
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success status of operation.
                    example: Success
                  message:
                    type: string
                    description: Message of success status of operation. 
                    example: "Successfully edited triage filter"
    delete:
      summary: Delete Rule
      tags:
      - v3.4/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint manages deleting rules from the system.
      operationId: v3.4_rule_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
        '400':
          description: Invalid query parameter requested.
          schema:
           $ref: '#/definitions/Error400InvalidParams'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
  /api/v3.4/data_source/connectors/:
    get:
      summary: Get Cloud Data Source Connector List
      description: |
        Cloud Data Source Connector objects contain information related to cloud data source connectors configured in the environment.
        This information includes but is not limited to:
          * Connector ID
          * Connector Name
          * Connector Type
          * Connector State
          * Region
          * Created At
          * Error
          * Updated At
          * Properties (connector-specific data including last_log_received)
      operationId: v3.4_data_source_connectors_list
      parameters:
        - description: A search term.
          in: query
          name: search
          required: false
          type: string
        - description: Which field to use when ordering the results.
          in: query
          name: ordering
          required: false
          type: string
        - description: A page number within the paginated result set.
          in: query
          name: page
          required: false
          type: integer
        - description: Number of results to return per page.
          in: query
          name: page_size
          required: false
          type: integer
      responses:
        '400':
          description: 'Bad request error.'
          schema:
            $ref: '#/definitions/Error400InvalidParams'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3.4/data_source/connectors/?page=2&page_size=1
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/DataSourceConnectorSerializerV3_4'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.4/data_source/connectors
    parameters: []
  /api/v3.4/detections/:
    get:
      summary: Get Detection List
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Detections are grouped into one of the following categories:
        | Detection Category  | URL |
        | -------- | ------- |
        | Command & Control  | /detections?detection_category=command    |
        | Botnet | /detections?detection_category=botnet     |
        | Reconnaissance    | /detections?detection_category=reconnaissance    |
        | Lateral Movement    | /detections?detection_category=lateral    |
        | Exfiltration    | /detections?detection_category=exfiltration    |
        | Info    | /detections?detection_category=info    |

        The API query performs partial word match. For example, you can use /detections?
        detection_category=recon to query all Reconnaissance category detections.
        
        Please note that AWS imposes a 30 second timeout window for all requests. As a result, this endpoint may timeout when trying to query large amounts of complex detection data. If experiencing 504 responses, please try to adjust the number of detections returned by using the 'page_size' query parameter.

        Starting in API Version 3.4, INFO detections are filtered out by default. To include INFO detections in the response, use the include_info_category query param.

      operationId: v3.4_detections_list
      parameters:
      - $ref: '#/components/parameters/DetectionsParamsV3/ordering'
      - $ref: '#/components/parameters/DetectionsParamsV3/page'
      - $ref: '#/components/parameters/DetectionsParamsV3/page_size'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/canonicalize'
      - $ref: '#/components/parameters/DetectionsParamsV3/certainty'
      - $ref: '#/components/parameters/DetectionsParamsV3/certainty_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/created_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/created_timestamp_lte'
      - $ref: '#/components/parameters/DetectionsParamsV3/description'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection_type'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection_category'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/entity_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/exclude_fields'
      - $ref: '#/components/parameters/DetectionsParamsV3/fields'
      - $ref: '#/components/parameters/DetectionsParamsV3/host_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/id'
      - $ref: '#/components/parameters/DetectionsParamsV3.4/include_info_category'
      - $ref: '#/components/parameters/DetectionsParamsV3/is_targeting_key_asset'
      - $ref: '#/components/parameters/DetectionsParamsV3/is_triaged'
      - $ref: '#/components/parameters/DetectionsParamsV3/last_timestamp'
      - $ref: '#/components/parameters/DetectionsParamsV3/last_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/last_timestamp_lte'
      - $ref: '#/components/parameters/DetectionsParamsV3/min_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/max_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/note_modified_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3.4/reason'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/src_account'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/src_account_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/src_ip'
      - $ref: '#/components/parameters/DetectionsParamsV3/state'
      - $ref: '#/components/parameters/DetectionsParamsV3/tags'
      - $ref: '#/components/parameters/DetectionsParamsV3/threat'
      - $ref: '#/components/parameters/DetectionsParamsV3/threat_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/type'
      - name: include_info_category
        required: false
        type: boolean
        description: Boolean to include 'info' type detections. By default this is false.
        in: query
      - name: include_src_dst_groups
        required: false
        type: boolean
        description: Boolean to include source and destination groups in the response. By default this is false.
        in: query
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3.4/detections?page=3&page_size=1
              previous:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3.4/detections?page=1&page_size=1
              results:
                items:
                  $ref: '#/definitions/DetectionSerializerV3_4'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.4/detections
    parameters: []
    patch:
      summary: Mark Detections as Fixed
      description: |
        Marking a detection as Fixed indicates that some remedial action was taken based upon the detection.
        Threat and Certainty scores will both be 0 once a detection has been marked as fixed.
      operationId: v3.4_detections_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            detectionIdList:
              description: Detections ids to mark/unmark as fixed.
              items:
                type: integer
                example: 1
              type: array
            mark_as_fixed:
              description: Flag to mark/unmark as fixed.
              type: boolean
              example: true 
          required:
          - detectionIdList
          - mark_as_fixed
          type: object
      responses:
        '404':
          description: Not found error.
          schema:
            $ref: '#/definitions/Error404PatchDetections'
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422PatchDetections'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success flag for patch.
                    example: Success
                  message:
                    type: string
                    description: Operation message.
                    example: "Successfully marked detections"
      tags:
      - v3.4/detections
  /api/v3.4/detections/{id}/:
    get:
      summary: Get Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

      operationId: v3.4_detections_read
      parameters:
      - description: Fields to include in the response object.
        enum:
        - id
        - url
        - detection_url
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        - campaign_summaries
        - grouped_details
        - summary
        - is_triaged
        - src_linked_account
        - reason
        in: query
        name: fields
        required: false
        type: string
      - description: Fields to exclude in the response object.
        enum:
        - id
        - url
        - detection_url
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        - reason
        in: query
        name: exclude_fields
        required: false
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/DetectionSerializerV3_4'
      tags:
      - v3.4/detections
    parameters:
    - in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Edit Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Marking a detection as Fixed indicates that some remedial action was taken based upon the detection.
        Threat and Certainty scores will both be 0 once a detection has been marked as fixed.
      operationId: v3.4_detection_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            mark_as_fixed:
              description: Flag to mark/unmark as fixed.
              type: boolean
              example: true 
            note:
              description: Note to overwrite.
              type: string
              example: New note
            note_id:
              description: Note id to overwrite.
              type: integer
              example: 1
            triageAs:
              description: Label for one-time triage of a detection.
              type: string
              example: Benign Detection
          type: object
      responses:
        '422':
          description: Returned when request body is missing.
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: 'Returned when a triage filter has been created for the detection.'
        '200':
          description: 'Returned when a detection has been marked as fixed or a detection note has been updated.'
      tags:
      - v3.4/detections
  /api/v3.4/detections/{id}/pcap/:
    get:
      summary: Get Detection PCAP
      description: |
        Vectra API supports download of PCAP for a particular detection.

        The download of PCAP via API is subject to RBAC rules just like UI access.
        If a user's role does not permit viewing PCAP information,
        they will not be able to access PCAP via API as well.
      operationId: v3.4_detections_pcap_read
      parameters: []
      produces:
        - application/octet-stream
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - type: file
              title: Success
              description: The PCAP file will be downloaded for succesful requests.
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/detections
    parameters:
    - description: A unique integer value identifying this detection.
      in: path
      name: id
      required: true
      type: integer
  /api/v3.4/detections/{id}/close/:
    parameters:
    - description: A unique integer value identifying this detection.
      in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Close Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Closing a detection indicates that some remedial action was taken based upon the detection.
        Closing a detection will no longer contribute to the scoring.
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            reason:
              description: Reason for closing the detection.
              type: string
              example: remediated
              enum:
              - remediated
              - benign
          type: object
      responses:
        '400':
          description: Bad request
          schema:
            oneOf:
              - $ref: '#/definitions/Error400MissingReasonParam'
              - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '422':
          description: Returned when request body is missing.
          schema:
            $ref: '#/definitions/Error422InvalidReason'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Returned when a detection has been closed'
          schema:
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success flag for patch.
                    example: Success
                  message:
                    type: string
                    example: Successfully closed detection as remediated
      tags:
      - v3.4/detections
  /api/v3.4/detections/{id}/open/:
    parameters:
    - description: A unique integer value identifying this detection.
      in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Open Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Opening a detection will result in the detection being rescored.
      responses:
        '400':
          description: Bad request
          schema:
            oneOf:
              - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Returned when a detection has been opened'
          schema:
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success flag for patch.
                    example: Success
                  message:
                    type: string
                    example:  Successfully opened detection
      tags:
      - v3.4/detections
  /api/v3.4/detections/open/:
    patch:
      summary: Open Detections
      description: |
        Detection objects contain all the information related to security events detected in the environment.
        Opening detections will result in them being rescored.
      tags:
        - v3.4/detections
      requestBody:
        required: true
        content:
          "application/json":
            schema:
              type: object
              properties:
                detectionIdList:
                  type: array
                  items:
                    type: integer
                    minimum: 0
                  description: List of detection IDs to open.
              required:
                - detectionIdList
            example:
              detectionIdList: [83738, 220, 3323]
      responses:
        "200":
          description: Successfully re-opened detections.
          content:
            application/json:
              schema:
                type: object
                properties:
                  _meta:
                    type: object
                    properties:
                      level:
                        type: string
                        example: success
                      message:
                        type: string
                        example: Successfully re-opened detections
        "400":
          description: Bad request
          schema:
            oneOf:
              - $ref: '#/definitions/Error400JsonParse'
              - $ref: '#/definitions/Error400MissingDetectionIdList'
              - $ref: '#/definitions/Error400DetectionIdListInvalidIdType'
              - $ref: '#/definitions/Error400DetectionIdListInvalidType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        "403":
          description: Invalid Permissions
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/Error404InvalidDetectionId'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
  /api/v3.4/detections/close/:
    patch:
      summary: Close Detections
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Closing detections indicates that some remedial action was taken based upon the detections.
        Closing a detection will no longer contribute to the scoring.
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            detectionIdList:
              description: List of detections IDs corresponsing to the detections that need to be closed.
              type: list
              example: [83738, 220, 3323]
            reason:
              description: Reason for closing the detection.
              type: string
              example: remediated
              enum:
              - remediated
              - benign
          type: object
      responses:
        "200":
          description: Successfully closed detections.
          content:
            application/json:
              schema:
                type: object
                properties:
                  _meta:
                    type: object
                    properties:
                      level:
                        type: string
                        example: success
                      message:
                        type: string
                        example: 'Successfully closed detections as remediated'
        "400":
          description: Bad request
          schema:
            oneOf:
              - $ref: '#/definitions/Error400MissingReasonParam'
              - $ref: '#/definitions/Error400JsonParse'
              - $ref: '#/definitions/Error400MissingDetectionIdList'
              - $ref: '#/definitions/Error400DetectionIdListInvalidType'
              - $ref: '#/definitions/Error400DetectionIdListInvalidIdType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        "404":
            description: Not Found
            schema:
              $ref: '#/definitions/Error404InvalidDetectionId'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '422':
          description: Returned when request body is missing.
          schema:
            $ref: '#/definitions/Error422InvalidReason'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
      tags:
      - v3.4/detections
  /api/v3.4/entities/:
    get:
      summary: Get Entity List
      description: |
        Entities is an overarching term to cover various types of models, including Accounts and Hosts.
        Entities are returned with an entity type, indicating what type of entity it is,
        along with urgency, importance, and fields from the original model.
      operationId: v3.4_entities_list
      parameters:
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/ordering'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/page'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/page_size'
        - $ref: '#/components/parameters/EntitiesListParamsV3_4/exclude_fields'
        - $ref: '#/components/parameters/EntitiesListParamsV3_4/fields'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/id'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/is_prioritized'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_3/last_detection_timestamp_lte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_3/last_modified_timestamp_gte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_3/last_modified_timestamp_lte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/name'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/state'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/tags'
        - $ref: '#/components/parameters/EntitiesListParamsV3_3/type'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400RepeatedType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/EntityListSerializerV3_4'
                type: array
      tags:
      - v3.4/entities
    parameters: []
  /api/v3.4/entities/{id}/:
    get:
      summary: Get Single Entity
      description: |
        Entities is an overarching term to cover various types of models, including Accounts and Hosts.
        Entities are returned with an entity type, indicating what type of entity it is,
        along with urgency, importance, and fields from the original model.
      operationId: v3.4_entities_read
      parameters:
      - $ref: '#/components/parameters/EntitiesReadParamsV3_4/type'
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/EntityDetailSerializerV3_4'
      tags:
      - v3.4/entities
    parameters:
    - in: path
      name: id
      required: true
      type: integer
  /api/v3.4/events/audits/:
    get:
      summary: Get Audit Log Events
      description: |
        Audit Log Events are generated when a user action is performed on the system. Audit Log Event are
        sequential and can be used to create an audit trail of user activity on your system.

        > NOTE: Audit events are persisted for 1 year.

        Example URL to retrieve audit events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.4/events/audits?from=101`.
      operationId: v3.4_events_audits_list
      parameters:
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_timestamp_lte'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/from'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/user_id'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_object'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_action'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/ordering'
      responses:
        '400':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/AuditEventSerializerV3'
      tags:
      - v3.4/events
    parameters: []
  /api/v3.4/events/detections/:
    get:
      summary: Get Detection Events
      description: |
        Detection Events are generated upon initial detection and for each update of the detection.

        Example URL to retrieve detection events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.4/events/detections?from=101`.
      operationId: v3.4_events_detections_list
      parameters:
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/account_uid'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/event_timestamp_lte'
        # - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/entity_type' - DEPRECATED IN 3.4
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/detection_id'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/from'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/id'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/include_info_category'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/include_triaged'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/limit'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/ordering'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/type'
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400RepeatedType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                items:
                  $ref: '#/definitions/DetectionEventSerializerV3_4'
                type: array
      tags:
      - v3.4/events
    parameters: []
  /api/v3.4/events/entity_scoring/:
    get:
      summary: Get Entity Scoring Events
      description: |
        Entity Scoring Events are generated when an entity score is changed, which occurs upon initial threat
        detection, discovery of additional detections, and updates to any discovered detections. The entity
        score is reduced over time if the underlying detection behavior subsides, either because of user
        intervention or because the account has left the environment.

        Host scoring events prior to May 2023 will have score_decrease enabled to false, so that all scoring
        events will be returned. Host scoring events starting May 2023 will be able to be filtered by the
        include_score_decreases query param.

        NOTE: You must include the type query param in your request to specify if you would like "account" or
        "host" entity scoring events

        Example URL to retrieve entity scoring events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.4/events/entity_scoring?from=101`.
      operationId: v3.4_events_entity_scoring_list
      parameters:
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/event_timestamp_lte'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/from'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/include_score_decreases'
        # - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/entity_type' - DEPRECATED IN 3.4
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/type'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/limit'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/ordering'
      responses:
        '404':
          description: 'Not found error.'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
              - $ref: '#/definitions/Error400RepeatedType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/EntityScoringEventSerializerV3_4'
      tags:
      - v3.4/events
  /api/v3.4/events/health/:
    get:
      summary: Get Health Events
      description: |
        Health Events are generated when health checks are performed on your appliance and sensors.
        Example URL to retrieve health events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.4/events/health?from=101`.
      operationId: v3.4_events_health_list
      tags:
        - v3.4/events/health
      parameters:
        - name: event_timestamp_gte
          in: query
          description: Filter on event timestamps greater than or equal to the provided time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z)
          required: false
          type: string
          format: date-time
        - name: event_timestamp_lte
          in: query
          description: Filter on event timestamps less than or equal to the provided time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z)
          required: false
          type: string
          format: date-time
        - name: from
          in: query
          description: Filter to provide a checkpoint for event ids. Depending on ordering scheme, returns ids greater than or less than the value, inclusive.
          required: false
          type: integer
          minimum: 1
        - name: limit
          in: query
          description: Maximum number of results to return (overrides pagination, must be > 0).
          required: false
          type: integer
          minimum: 1
        - name: ordering
          in: query
          description: Which field to use when ordering the results.
          required: false
          type: string
          enum:
            - event_timestamp
            - -event_timestamp
            - event_health_check_name
            - -event_health_check_name
            - event_object_name
            - -event_object_name
        - name: entity_type
          in: query
          description: Filter on the entity type to return.
          required: false
          type: string
          enum: [device, brain, sensor]
        - name: health_check_name
          in: query
          description: Filter on the health check name to return (case-insensitive contains search).
          required: false
          type: string
        - name: entity_name
          in: query
          description: Filter on the entity name to return (case-insensitive contains search).
          required: false
          type: string
        - name: status
          in: query
          description: Filter on the status to return (supports both numeric codes and status labels).
          required: false
          type: string
          enum: [0, 1, 2, 3, 4, 5, 6, 11, OK, WARNING, CRITICAL, SKIP, UNKNOWN, TIMEOUT, INFO, ERROR]
      responses:
        '404':
          description: 'Not found error.'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - type: object
                title: Invalid query parameters
                description: 'Invalid query parameters requested.'
                properties:
                  detail:
                    type: string
                    enum: 
                    - 'The following query parameter(s) are invalid: invalid_param'
              - type: object
                title: Invalid query parameter values
                description: ''
                properties:
                  valid_param:
                    type: string
                    enum: 
                    - "Invalid value given for paramater 'valid_param'. Valid values: ['valid_value']"
                  _meta:
                    type: object
                    properties:
                      message:
                        type: string
                        enum:
                        - "Ivalid field(s) found"
                      level:
                        type: string
                        enum:
                        - error
        '401':
          description: 'Authentication error.'
          schema:
            type: object
            title: Authentication error
            description: 'Authentication error.'
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    enum:
                    - error
                  message:
                    type: string
                    enum:
                    - 'Authentication error.'
        '403':
          description: 'Authorization error.'
          schema:
            type: object
            title: Authorization error
            description: 'Authorization error.'
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    enum:
                    - error
                  message:
                    type: string
                    enum:
                    - 'Authorization error.'
        '413':
          description: 'Response too large error.'
          schema:
            type: object
            title: Response too large error
            description: 'Response too large error.'
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    enum:
                    - error
                  message:
                    type: string
                    enum:
                    - 'Response too large error.'
        '429':
          description: 'Too many requests error.'
          schema:
            type: object
            title: Too many requests error
            description: 'Too many requests error.'
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    enum:
                    - error
                  message:
                    type: string
                    enum:
                    - 'Too many requests error.'
        '500':
          description: 'Unexpected error.'
          schema:
            type: object
            title: Unexpected error
            description: 'Unexpected error.'
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    enum:
                    - error
                  message:
                    type: string
                    enum:
                    - 'Unexpected error.'
        '503':
          description: 'Service unavailable error.'
          schema:
            type: object
            title: Service unavailable error
            description: 'Service unavailable error.'
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    enum:
                    - error
                  message:
                    type: string
                    enum:
                    - 'Service unavailable error.'
        '504':
          description: 'Time out error.'
          schema:
            type: object
            title: Time out error
            description: 'Time out error.'
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    enum:
                    - error
                  message:
                    type: string
                    enum:
                    - 'Time out error.'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/HealthCheckEvent'
  /api/v3.4/groups/:
    get:
      summary: Get Group List
      description: |
        The Groups API can retrieve a listing of Groups that are defined on the system.

        Version 3.4 of Groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        account/IP/host/domain Groups, but also create, modify, or delete them.

        Note that Dynamic Groups with large amounts of members may cause the endpoint to time out. To avoid
        this, please set the “include_members” query parameter to False.
      operationId: v3.4_groups_list
      parameters:
        - $ref: '#/components/parameters/GroupsListParamsV3_2/ordering'
        - $ref: '#/components/parameters/GroupsListParamsV3_2/page'
        - $ref: '#/components/parameters/GroupsListParamsV3_2/page_size'
        - $ref: '#/components/parameters/GroupsListParamsV3_2/account_ids'
        - $ref: '#/components/parameters/GroupsListParamsV3_2/account_names'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/ad_group_dn'
        - $ref: '#/components/parameters/GroupsListParamsV3_2/description'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/domains'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/host_ids'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/host_names'
        - $ref: '#/components/parameters/GroupsListParamsV3_2/importance'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/include_members'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/is_ad_group'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/is_membership_evaluation_ongoing'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/is_regex'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/include_members'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/ips'
        - $ref: '#/components/parameters/GroupsListParamsV3_2/last_modified_by'
        - $ref: '#/components/parameters/GroupsListParamsV3_2/last_modified_timestamp'
        - $ref: '#/components/parameters/GroupsListParamsV3_2/name'
        - $ref: '#/components/parameters/GroupsListParamsV3_4/type'

      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/GroupSerializerV3_4'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.4/groups
    parameters: []
    post:
      summary: Create Group
      description: |
        The Groups API can retrieve a listing of Groups that are defined on the system.

        Version 3.4 of Groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        account/IP/host/domain Groups, but also create, modify, or delete them.

        Use Account uids to assign Account Group membership. Use Host IDs to assign Host Group membership.
      operationId: v3.4_groups_create
      requestBody:
        $ref: '#/components/requestBodies/GroupPostBodyV3_4'
      parameters:
      - in: body
        name: data
        required: true
      responses:
        '409':
          description: 'Name conflict error.'
          schema:
            $ref: '#/definitions/Error409PostGroups'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400InvalidJson'
            - $ref: '#/definitions/Error400InvalidBodyParam'
        '415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error422GroupsInvalidType'
            - $ref: '#/definitions/Error422GroupsMissingBodyParam'
            - $ref: '#/definitions/Error422GroupsBody'
            - $ref: '#/definitions/Error422GroupsRegexConflict'
            - $ref: '#/definitions/Error422GroupsRegexInvalid'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            properties:
              group:
                type: object
                properties:
                  id:
                    type: integer
                    example: 1
      tags:
      - v3.4/groups
  /api/v3.4/groups/{id}/:
    delete:
      summary: Delete Group
      description: |
        The Groups API can retrieve a listing of Groups that are defined on the system.

        Version 3.4 of Groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        account/IP/host/domain Groups, but also create, modify, or delete them.
      operationId: v3.4_groups_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422GroupsDelete'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.4/groups
    get:
      summary: Get Single Group
      description: |
        The Groups API can retrieve data for individual Groups.

        Note that Dynamic Groups with large amounts of users may cause the endpoint to time out. To avoid
        this, please set the “include_members” query parameter to False.
      operationId: v3.4_groups_read
      parameters:
      - description: Flag to include members in the response object. Regex Groups may return many members.
            By default this is true.
        in: query
        name: include_members
        required: false
        type: boolean
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/GroupSerializerV3_4'
      tags:
      - v3.4/groups
    parameters:
    - description: A unique integer value identifying this group collection.
      in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Edit Group
      description: |
        The Groups API can retrieve a listing of groups that are defined on the system.

        Version 3.4 of Groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        account/IP/host/domain Groups, but also create, modify, or delete them.

        When using the default PATCH functionality to modify the members, a complete new list must be included. For
        example, if a group already contains accounts "acct1@test.com", and "acct2@test.com", and the group should be
        modified to include account "acct5@test.com", then "acct5@test.com" should be added to the list, the members
        field of the PATCH request should be "acct1@test.com","acct2@test.com","acct5@test.com".

        Alternatively, the "membership_action" query parameter can be passed in with a value of "replace", "append", or
        "remove". The "append" and "remove" values will only affect members listed in the request body; if a user wants to
        add or remove account "acct1@test.com" for a group, then the user can pass the members field of
        "acct1@test.com" in the request body with the appropriate value of "membership_action". The "replace" value will
        perform the default PATCH behavior.

        Regex Groups and AD Groups may be patched but their members cannot be manually changed. Regex Groups can be transitioned to Static Groups when regex is defined as null. Static Groups can be transitioned to Regex Groups when regex is defined. AD Groups can be transitioned to Static Groups when ad_group_dn is defined as null.
      operationId: v3.4_groups_partial_update
      requestBody:
        $ref: '#/components/requestBodies/GroupPostBodyV3_4'
      parameters:
      - in: body
        name: data
        required: true

      - description: Flag to specify the membership update to be performed. If this
          is not specified, the default action is membership replacement.
        enum:
        - remove
        - replace
        - append
        in: query
        name: membership_action
        required: false
        type: string
      responses:
        '409':
          description: 'Name conflict error.'
          schema:
            $ref: '#/definitions/Error409PostGroups'
        '415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaTypeDetail'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400JsonParse'
              - $ref: '#/definitions/Error400InvalidBodyParam'
              - $ref: '#/definitions/Error400GroupsPatchTypeChange'
              - $ref: '#/definitions/Error400InvalidJson'
              - $ref: '#/definitions/Error422GroupsRegexConflict'
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error422GroupsBody'
            - $ref: '#/definitions/Error422GroupsRegexInvalid'
            - $ref: '#/definitions/Error422GroupsRegexConflict'
            - $ref: '#/definitions/Error422GroupsInvalidType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/GroupSerializerV3_4'
      tags:
      - v3.4/groups
  /api/v3.4/groups/{id}/members/:
    get:
      summary: Get Group Members
      description: |
        The Group Members API can retrieve group members from individual groups.

        Note that responses will be different per group type. 
      operationId: v3.4_group_members_get
      parameters:
      - description: |
          Option to order the records by name or ID. By default the results are sorted by ID in descending order.
          Sort in descending order by prepending the query with “minus” symbol
        in: query
        name: ordering
        required: false
        type: string
        example: -id
      - description: A page number within the paginated result set.
        in: query
        name: page
        required: false
        type: integer
        minimum: 1
        example: 5
      - description: Number of results to return per page.
        in: query
        name: page_size
        required: false
        type: integer
        minimum: 1
        maximum: 5000
        example: 10
      - description: Filters group members by name, uid, ip, or domain.
        in: query
        name: name
        required: false
        type: string
      - description: Filters host group members by whether or not they are key assets.
        in: query
        name: is_key_asset
        required: false
        type: boolean
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/GroupMemberHostV3_4'
              title: Host Members
            - $ref: '#/definitions/GroupMemberAccountV3_4'
              title: Account Members
            - $ref: '#/definitions/GroupMemberIPV3_4'
              title: IP Members
            - $ref: '#/definitions/GroupMemberDomainV3_4'
              title: Domain Members
      tags:
      - v3.4/groups
    parameters:
    - description: A unique integer value identifying this group collection.
      in: path
      name: id
      required: true
      type: integer
  /api/v3.4/settings/active_directory/groups/:
    get:
      summary: Get Settings Groups Active Directory
      description: |
        The Settings Groups Active Directory API can retrieve a listing of Active Directory Distinguished Names from connected Active Directories.
      operationId: v3.4_settings_groups_active_directory_get
      parameters:
      - description: A page number within the paginated result set.
        in: query
        name: page
        required: false
        type: integer
        minimum: 1
        example: 5
      - description: Number of results to return per page.
        in: query
        name: page_size
        required: false
        type: integer
        minimum: 1
        maximum: 5000
        example: 10
      - description: Filter by AD profile name.
        in: query
        name: ad_profile_name
        required: false
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/SettingsActiveDirectoryGroupsSerializerV3_4'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.4/settings/active_directory/groups
  /api/v3.4/health/:
    get:
      summary: Get Health
      description: |
        The health API can retrieve a listing of system health information.

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      operationId: v3.4_health_read
      parameters:
        - $ref: '#/components/parameters/HealthParamsV3_3/cache'
        - $ref: '#/components/parameters/HealthParamsV3_3/vlans'
      # parameters:
      # - default: true
      #   description: Flag to used cached data. If set to true, the response will include
      #     an 'updated_at' property with the time at which the health check was performed.
      #     Cached values will be no older than five minutes. Setting this to false
      #     will force a new health check.
      #   in: query
      #   name: cache
      #   required: false
      #   type: boolean
      # - default: true
      #   description: Flag to include or omit the list of VLANs observed from the returned
      #     data. Large environments with many vlans can result in slow performance
      #     from /health.
      #   in: query
      #   name: vlans
      #   required: false
      #   type: boolean
      responses:
        '400':
          description: 'Invalid health check error.'
          schema:
            $ref: '#/definitions/Error400InvalidHealthCheck'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/HealthSerializerV3_4'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/health
    parameters: []
  /api/v3.4/health/{check_type}/:
    get:
      summary: Get Health Check
      description: |
        The health API can retrieve a listing of system health information.

        This endpoint returns health information for a specific check type.

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      operationId: v3.4_health_read_check_type
      parameters:
        - $ref: '#/components/parameters/HealthParamsV3_3/cache'
        - $ref: '#/components/parameters/HealthParamsV3_3/vlans'
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
              - type: object
                title: CPU
                properties:
                  cpu:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/cpu'
              - type: object
                title: Disk
                properties:
                  disk:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/disk'
              - type: object
                title: Network
                properties:
                  network:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/network'
              - type: object
                title: Power
                properties:
                  power:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/power'
              - type: object
                title: Sensor
                properties:
                  sensor:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/sensors'
              - type: object
                title: System
                properties:
                  system:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/system'
              - type: object
                title: Host ID
                properties:
                  hostid:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/hostid'
              - type: object
                title: Connectivity
                properties:
                  connectivity:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/connectivity'
              - type: object
                title: Traffic drop
                properties:
                  trafficdrop:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/trafficdrop'
              - type: object
                title: Detection
                properties:
                  detection:
                    $ref: '#/definitions/HealthDetectionSerializerV3_4'
              - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/health
    parameters:
    - description: Filter on the type of health check.
      enum:
      - cpu
      - disk
      - memory
      - network
      - power
      - sensors
      - system
      - hostid
      - connectivity
      - trafficdrop
      in: path
      name: check_type
      required: true
      type: string
  /api/v3.4/hosts/:
    get:
      summary: Get Host List
      description: |
        Host information includes data that correlates the host data to detected security events.
        This information includes but is not limited to:
          *	Hostname
          *	IP address
          *	Threat score
          *	Certainty score

        API responses may vary depending on product subscriptions (Network, AWS, M365).

        Note: For those experiencing 504 responses from the /hosts API, the all_active query parameter set to 'true' can improve performance and alleviate timeouts. Reducing the page_size can help with timeouts as well.
      operationId: v3.4_hosts_list
      parameters:
        - $ref: '#/components/parameters/HostsListParamsV3_3/ordering'
        - $ref: '#/components/parameters/HostsListParamsV3_3/page'
        - $ref: '#/components/parameters/HostsListParamsV3_3/page_size'
        - $ref: '#/components/parameters/HostsListParamsV3_3/active_traffic'
        - $ref: '#/components/parameters/HostsListParamsV3_3/all'
        - $ref: '#/components/parameters/HostsListParamsV3_3/all_active'
        - $ref: '#/components/parameters/HostsListParamsV3_3/c_score'
        - $ref: '#/components/parameters/HostsListParamsV3_3/c_score_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/certainty'
        - $ref: '#/components/parameters/HostsListParamsV3_3/certainty_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/exclude_fields'
        - $ref: '#/components/parameters/HostsListParamsV3_3/fields'
        - $ref: '#/components/parameters/HostsListParamsV3_3/has_active_traffic'
        - $ref: '#/components/parameters/HostsListParamsV3_3/include_detection_summaries'
        - $ref: '#/components/parameters/HostsListParamsV3_3/is_key_asset'
        - $ref: '#/components/parameters/HostsListParamsV3_3/is_targeting_key_asset'
        - $ref: '#/components/parameters/HostsListParamsV3_3/key_asset'
        - $ref: '#/components/parameters/HostsListParamsV3_3/last_detection_timestamp'
        - $ref: '#/components/parameters/HostsListParamsV3_3/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/last_detection_timestamp_lte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/last_source'
        - $ref: '#/components/parameters/HostsListParamsV3_3/mac_address'
        - $ref: '#/components/parameters/HostsListParamsV3_3/max_id'
        - $ref: '#/components/parameters/HostsListParamsV3_3/min_id'
        - $ref: '#/components/parameters/HostsListParamsV3_3/name'
        - $ref: '#/components/parameters/HostsListParamsV3_3/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/privilege_category'
        - $ref: '#/components/parameters/HostsListParamsV3_3/privilege_level'
        - $ref: '#/components/parameters/HostsListParamsV3_3/privilege_level_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/state'
        - $ref: '#/components/parameters/HostsListParamsV3_3/t_score'
        - $ref: '#/components/parameters/HostsListParamsV3_3/t_score_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/tags'
        - $ref: '#/components/parameters/HostsListParamsV3_3/targets_key_asset'
        - $ref: '#/components/parameters/HostsListParamsV3_3/threat'
        - $ref: '#/components/parameters/HostsListParamsV3_3/threat_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/uuid'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/HostSerializerV3_4'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.4/hosts
    parameters: []
  /api/v3.4/hosts/{id}/:
    get:
      summary: Get Single Host
      description: |
        Host information includes data that correlates the Host data to detected security events.
        This information includes but is not limited to:
          *	Hostname
          *	IP address
          *	Threat score
          *	Certainty score

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      operationId: v3.4_hosts_read
      parameters:
        - $ref: '#/components/parameters/HostsReadParamsV3_3/exclude_fields'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/fields'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_access_history'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_edrs'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_external'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_detection_summaries'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_host_roles'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_ldap'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'  
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/SingleHostSerializerV3_3'
      tags:
      - v3.4/hosts
    parameters:
    - in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Edit Host
      description: |

        The PATCH operation is used to set or remove the key asset flag on a host.

      operationId: v3.4_hosts_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            key_asset:
              description: Flag to set host as a key asset.
              enum:
              - 'true'
              - 'false'
              type: string
              example: true
            note:
              description: Host note to overwrite.
              type: string
              example: Example note
            note_id:
              description: Host note id to overwrite. If not declared oldest note
                is overwritten.
              type: integer
              example: 1
              minimum: 1
          type: object
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
      tags:
      - v3.4/hosts
  /api/v3.4/hosts/{id}/close/:
    patch:
      summary: Close Single Host
      description: |
        Host objects contain all the information related to hosts observed in the environment.

        Closing a host indicates that some remedial action was taken based upon the host.
        Active detections associated with the host will be closed resulting in the detections no longer contributing to the scoring.
      parameters:
      - description: A unique integer value identifying this host.
        in: path
        name: id
        required: true
        type: integer
      - in: body
        name: data
        required: true
        schema:
          properties:
            reason:
              description: Reason for closing the host.
              type: string
              example: remediated
              enum:
              - remediated
              - benign
          type: object
      responses:
        '200':
          description: 'Returned when a host has been closed'
          schema:
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success flag for patch.
                    example: success
                  message:
                    type: string
                    example:  Successfully closed host as remediated
              detections_closed:
                type: list
                description: The list of IDs of detections associated with the host that were closed.
                example: [123, 456, 789]
        '400':
          description: Bad request
          schema:
            oneOf:
              - $ref: '#/definitions/Error400MissingReasonParam'
              - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '422':
          description: Returned when reason in request body is invalid.
          schema:
            $ref: '#/definitions/Error422InvalidReason'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
      tags:
      - v3.4/hosts
  /api/v3.4/lockdown/:
    get:
      summary: Get Lockdown List
      description: |
        This is a new endpoint for retrieving a list of entities (accounts, hosts) that are currently in "lockdown"
        mode. API responses may vary depending on product subscriptions (Network, AWS, M365).
      operationId: v3.4_lockdown_list
      parameters:
        - $ref: '#/components/parameters/LockdownListParamsV3_3/type'
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400RepeatedType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            items:
              $ref: '#/definitions/LockdownSerializerV3_4'
            type: array
      tags:
      - v3.4/lockdown
    parameters: []
  /api/v3.4/tagging/{table}/:
    delete:
      summary: Bulk Delete Tag
      description: |
        The tagging API can be used to manage tags for accounts, detections, and hosts.

        An API client can use this endpoint to delete a tag for a list of entities.
      operationId: v3.4_tagging_delete
      requestBody:
        $ref: '#/components/requestBodies/BulkTaggingBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
            - $ref: '#/definitions/Error400TaggingInvalidType'
            - $ref: '#/definitions/Error400InvalidParams'
            - $ref: '#/definitions/Error400PatchTagsMissingTags'
            - $ref: '#/definitions/Error400BulkInvalidTag'
        '404':
          description: Not found error.
          schema:
              $ref: '#/definitions/Error404BulkPatchTags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3.4/tagging
    parameters:
      - $ref: "#/components/parameters/TaggingParamsV3_3/table"
      - $ref: "#/components/parameters/TaggingParamsV3_4/type"
    post:
      summary: Bulk Create Tag
      description: |
        The tagging API can be used to manage tags for accounts, detections, and hosts.

        An API client can use this endpoint to create a tag for a list of entities.
      operationId: v3.4_tagging_create
      requestBody:
        $ref: '#/components/requestBodies/BulkTaggingBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400BulkInvalidTag'
              - $ref: '#/definitions/Error400JsonParse'
              - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
              - $ref: '#/definitions/Error400TaggingInvalidType'
              - $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: Not found error.
          schema:
              $ref: '#/definitions/Error404BulkPatchTags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3.4/tagging
  /api/v3.4/tagging/{table}/{entity_id}/:
    get:
      summary: Get Entity Tag List
      description: |
        The tagging API can be used to manage tags for accounts, detections, and hosts.

        An API client can use this endpoint to list tags for a single entity.
      operationId: v3.4_tagging_read
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Tags'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
            - $ref: '#/definitions/Error400TaggingInvalidType'
            - $ref: '#/definitions/Error400InvalidParams'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TaggingSerializerV3'
      tags:
      - v3.4/tagging
    parameters:
      - $ref: "#/components/parameters/TaggingParamsV3_3/table"
      - $ref: "#/components/parameters/TaggingParamsV3_4/type"
      - $ref: "#/components/parameters/TaggingParamsV3/entity_id"
    patch:
      summary: Edit Entity Tag
      description: |
        The tagging API can be used to manage tags for accounts, detections, and hosts.

        An API client can use this endpoint to replace all tags for an entity with a list of tags.
      operationId: v3.4_tagging_partial_update
      requestBody:
        $ref: '#/components/requestBodies/TaggingBodyV3'
      responses:
        '400':
          description: Invalid input error.
          schema:
            oneOf:
              - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
              - $ref: '#/definitions/Error400TaggingInvalidType'
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400PatchTagsInvalidTagType'
              - $ref: '#/definitions/Error400PatchTagsInvalidTag'
              - $ref: '#/definitions/Error400JsonParse'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Tags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TaggingSerializerV3'
      tags:
      - v3.4/tagging
  /api/v3.4/users/:
    get:
      summary: Get User List
      description: |
        User objects contain information about users that have access to the Vectra system. 
        Assignments can be created for users via the Assignments endpoint.
      operationId: v3.4_users_list
      parameters:
        - $ref: '#/components/parameters/UsersListParamsV3_3/page'
        - $ref: '#/components/parameters/UsersListParamsV3_3/page_size'
        - $ref: '#/components/parameters/UsersListParamsV3_4/email'
        - $ref: '#/components/parameters/UsersListParamsV3_3/last_login_gte'
        - $ref: '#/components/parameters/UsersListParamsV3_4/role'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400UsersListRole'
            - $ref: '#/definitions/Error400InvalidParams'
            - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/UserSerializerV3_4'
                type: array
            required:
            - count
            - results
      tags:
      - v3.4/users
    post:
      summary: Create User
      description: |
        The endpoint for user creation with a local email login profile (non SAML profile).
        The endpoints does not support the creation of local user profiles for emails that
        have logged in with an existing SAML profile.
      operationId: v3.4_users_create
      requestBody:
        $ref: '#/components/requestBodies/UsersPostBodyV3_4'
      responses:
        '422':
          description: 'Invalid email error.'
          schema:
            $ref: '#/definitions/Error422UsersPostInvalidEmail'
        '415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400InvalidJson'
            - $ref: '#/definitions/Error400InvalidBodyParam'
            - $ref: '#/definitions/Error400UsersPostInvalidInput'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/UserSerializerV3_4'
      tags:
      - v3.4/users
    parameters: []
  /api/v3.4/users/{id}/:
    get:
      summary: Get Single User
      description: |
        User objects contain information about users that have access to the Vectra system. 
        Assignments can be created for users via the Assignments endpoint.
      operationId: v3.4_users_read
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/UserSerializerV3_4'
      tags:
      - v3.4/users
    patch:
      summary: Edit User
      description: |
        This endpoint can be used to modify the role and name of existing users. User modifications are
        limited to users that only have a local login profile. Users with both SAML and local profiles or SAML
        only users cannot be modified.
      operationId: v3.4_users_partial_update
      requestBody:
        $ref: '#/components/requestBodies/UsersPatchBodyV3_4'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400InvalidJson'
            - $ref: '#/definitions/Error400InvalidBodyParam'
            - $ref: '#/definitions/Error400UserInput'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/UserSerializerV3_4'
      tags:
      - v3.4/users
    delete:
      summary: Delete User
      description: |
        This endpoint can be used to delete users. This will deactivate a user's local and SAML profiles;
        SAML profiles can be reactivated by logging in again via the external provider.
        Note that the last verified super admin user cannot be deleted using this endpoint.
      operationId: v3.4_users_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error403'
            - $ref: '#/definitions/Error403DeleteUser'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.4/users
    parameters:
    - description: The user id.
      in: path
      name: id
      required: true
      type: integer
      minimum: 1
      example: 1
  /api/v3.4/users/roles/:
    get:
      summary: Get User Role List
      description: |
        This endpoint returns the available roles for user creation and modification.
      operationId: v3.4_users_roles_list
      parameters: []
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            items:
              $ref: '#/definitions/UserRoleSerializerV3_4'
            type: array
      tags:
      - v3.4/users
  /api/v3.4/vectra-match/alert-stats/:
    get:
      summary: Get Match Alert Stats
      description: |
        Use of the Alert Stats endpoint for Vectra Match does not require a valid license.

        The alert stats GET endpoint allows for a single optional query parameter, device_serial.
        If device_serial is not provided, information for all enabled devices will be returned.
      operationId: v3.4_vectra-match_alert-stats_list
      parameters:
        - $ref: '#/components/parameters/VectraMatchParamsV3_3/device_serial'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/MatchAlertStatsSerializerV3_3'
      tags:
      - v3.4/match
    parameters: []
  /api/v3.4/vectra-match/assignment/:
    get:
      summary: Get Match Assignment List
      description: |
        Vectra Match Assignment API supports GET, POST, and DELETE.
        Adding a new assignment via POST requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
      operationId: v3.4_vectra-match_assignment_list
      parameters: []
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchAssignmentSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/match
    parameters: []
    post:
      summary: Create Match Assignment
      description: |
        Vectra Match Assignment API supports GET, POST, and DELETE.
        Adding a new assignment via POST requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
      operationId: v3.4_vectra-match_assignment_create
      requestBody:
        $ref: '#/components/requestBodies/MatchAssignmentBodyV3_3'
      parameters:
      - in: body
        name: data
        required: true
      responses:
        ' 201':
          description: ''
          schema:
            $ref: '#/definitions/Response201MatchAssignment'
        ' 200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        ' 400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400MatchEnablement'
            - $ref: '#/definitions/Error400JsonParse'
        ' 401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        ' 403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        ' 404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        ' 413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        ' 415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        ' 429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        ' 500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        ' 503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        ' 504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
      tags:
      - v3.4/match
    delete:
      summary: Delete Match Assignment
      description: |
        Vectra Match Assignment API supports GET, POST, and DELETE.
        Adding a new assignment via POST requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
      operationId: v3.4_vectra-match_assignment_delete
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            device_serial:
              description: Device serial associated with the rule set
              type: string
              example: L839261748511729ceace80jh2g46f12ff
            uuid:
              description: UUID associated with the rule set.
              type: string
              example: "8cc9a23f-76e4-3035-8h5f-d4728d8g3h76"
          required:
          - uuid
          - device_serial
          type: object
      responses:
        ' 204':
          description: ''
          schema:
            properties:
              details:
                description: Details will be 'success' if successful, otherwise, will
                  contain information about the failure. 
                type: string
                example: success
            type: object
        ' 200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        ' 400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400MatchEnablement'
            - $ref: '#/definitions/Error400JsonParse'
        ' 401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        ' 403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        ' 404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        ' 413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        ' 415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        ' 429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        ' 500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        ' 503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        ' 504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            properties:
              details:
                description: Details will be 'success' if successful, otherwise, will
                  contain information about the failure. 
                type: string
                example: success
            type: object
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
      tags:
        - v3.4/match
  /api/v3.4/vectra-match/available-devices/:
    get:
      summary: Get Match Available Devices
      description: |
        Use of the Available Devices endpoint for Vectra Match does not require a valid license.

        The available devices endpoint will return information about all currently paired sensors and,
        in the case of a mixed mode headend, information about the headend itself.
      operationId: v3.4_vectra-match_available-devices_list
      parameters: []
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchAvailableDevicesSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/match
    parameters: []
  /api/v3.4/vectra-match/enablement/:
    get:
      summary: Get Match Enablement
      description: |
        Changing the enablement state on a given device using the POST endpoint requires a license for Vectra Match,
        and an audit log will be emitted (NOTE: a valid Vectra Match license is not required to disable
        Match on a previously enabled device if your license has expired).
      operationId: v3.4_vectra-match_enablement_list
      parameters:
      - description: Filter on the paired device serial number.
        in: query
        name: device_serial
        required: true
        type: string
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchEnablement'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchEnablementSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/match
    parameters: []
    post:
      summary: Create Match Enablement
      description: |
        Changing the enablement state on a given device using the POST endpoint requires a license for Vectra Match,
        and an audit log will be emitted (NOTE: a valid Vectra Match license is not required to disable
        Match on a previously enabled device if your license has expired).
      operationId: v3.4_vectra-match_enablement_create
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            desired_state:
              description: Flag to enable/disable Vectra Match.
              type: boolean
              example: true
            device_serial:
              description: Serial number of the associated device.
              type: string
              example: L839261748511729ceace80jh2g46f12ff
          required:
          - device_serial
          - desired_state
          type: object
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400JsonParse'
            - $ref: '#/definitions/Error400MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/MatchEnablementSerializerV3_3'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/match
  /api/v3.4/vectra-match/rules/:
    delete:
      summary: Delete Match Rule
      description: |
        Vectra Match rules API supports GET and DELETE.
        Uploading a rules file requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
        Once a rules file has been uploaded,
        the API will return a rules file uuid.
        This uuid will be used for managing the ruleset from that point forward,
        when interacting with the API.
      operationId: v3.4_vectra-match_rules_delete
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            uuid:
              description: UUID of the associated rules file.
              required: true
              type: string
              example: "8cc9a23f-76e4-3035-8h5f-d4728d8g3h76"
          type: object
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchEnablement'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        '204':
          description: ''
      tags:
      - v3.4/match
    get:
      summary: Get Match Rule
      description: |
        Vectra Match rules API supports GET and DELETE.
        Uploading a rules file requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
        Once a rules file has been uploaded,the API will return a rules file uuid.
        This uuid will be used for managing the ruleset from that point forward,
        when interacting with the API.
      operationId: v3.4_vectra-match_rules_list
      parameters:
      - description: Filter on UUID of the desired rules file.
        in: query
        name: uuid
        required: true
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchRulesSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/match
    parameters: []
    post:
      summary: Create Match Rule
      consumes:
      - multipart/form-data
      description: |
        This endpoint has been deprecated. Match roles may be updated at /api/v3.4/vectra-match/rules/upload/
      operationId: v3.4_vectra-match_rules_create
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            file:
              description: File to upload.
              type: file
            notes:
              description: Notes to store about the file.
              type: string
              example: Example note
            rotate:
              description: Flag for file replacement. If set to true,  if the Vectra
                system is above the 25 file limit, the oldest unassigned file will
                be deleted automatically, and replaced by the file currently being
                uploaded, if possible
              type: boolean
              example: true
          required:
          - file
          type: object
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/MatchRulesSerializerV3_3'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/deprecated
  /api/v3.4/vectra-match/stats/:
    get:
      summary: Get Match Stats
      description: |
        Use of the stats endpoint for Vectra Match does not require a valid license

        The stats GET endpoint allows for a single optional query parameter, device_serial. If device_serial is
        not provided, information for all enabled and previously-enabled devices will be returned.

      operationId: v3.4_vectra-match_stats_list
      parameters:
      - description: Filter on the paired device serial number.
        in: query
        name: device_serial
        required: false
        type: string
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchEnablement'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchStatsSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/match
    parameters: []
  /api/v3.4/vectra-match/status/:
    get:
      summary: Get Match Status
      description: |
        Use of the status endpoint for Vectra Match does not require a valid license

        The status GET endpoint allows for a single optional query parameter, device_serial.
        If device_serial isnot provided, information for all enabled and previously-enabled
        devices will be returned.
      operationId: v3.4_vectra-match_status_list
      parameters:
      - description: Filter on the paired device serial number.
        in: query
        name: device_serial
        required: false
        type: string
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchEnablement'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchStatusSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/match
    parameters: []
  /api/v3.4/{tvui_types}/notes/:
    parameters:
      - $ref: '#/components/parameters/NotesParamsV3_3/tvui_types'
      - $ref: '#/components/parameters/NotesParamsV3_4/type'
    post:
      summary: Bulk Create Note
      description: |
        The note API can be used to manage notes for accounts, detections, and hosts.

        An API client can use this endpoint to create a notes for a list of entities. There is no max limit on the number of 
        entity ids that can be included in the request body. An audit event will be created when successfully creating notes
        via this endpoint; the audit will only capture the first 50 ids provided in the request body. 
      operationId: v3.4_bulk_notes_create
      requestBody:
        $ref: '#/components/requestBodies/BulkCreateNotesBodyV3_3'
      responses:
        '400':
          description: 'Entity type required error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
            - $ref: '#/definitions/Error400JsonParse'
            - $ref: '#/definitions/Error400InvalidParams'
            - $ref: '#/definitions/Error400NoteInvalidType'
            - $ref: '#/definitions/Error400BulkNotesMissingBodyParam'
            - $ref: '#/definitions/Error400BulkNotesExtraBodyParam'
            - $ref: '#/definitions/Error400BulkNotesInvalidBodyValue'
            - $ref: '#/definitions/Error400BulkNotesEmptyValue'
            - $ref: '#/definitions/Error400InvalidJson'
        '404':
          description: Not found error.
          schema:
            oneOf:
            - $ref: '#/definitions/Error404BulkNotesNotFound'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '415':
          description: Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3.4/notes
  /api/v3.4/{tvui_types}/{type_id}/notes/:
    get:
      summary: Get Entity Note List
      description: |
        An API client can list all of the Note objects associated with a single entity using this endpoint.
      operationId: v3.4_notes_list
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '400':
          description: 'Entity type required error.'
          schema:
            $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            items:
              $ref: '#/definitions/NoteSerializerV2_2'
            type: array
      tags:
      - v3.4/notes
    parameters:
    - $ref: '#/components/parameters/NotesParamsV3_3/tvui_types'
    - $ref: '#/components/parameters/NotesParamsV3/type_id'
    - $ref: '#/components/parameters/NotesParamsV3_4/type'
    post:
      summary: Create Entity Note
      description: |
        An API client can use this endpoint to create a note for an entity.
      operationId: v3.4_notes_create
      requestBody:
        $ref: '#/components/requestBodies/NotesBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostNotes'
            - $ref: '#/definitions/Error400JsonParse'
            - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.4/notes
  /api/v3.4/{tvui_types}/{type_id}/notes/{note_id}/:
    delete:
      summary: Delete Entity Note
      description: |
        An API client can use this endpoint to delete a note for an entity.
      operationId: v3.4_notes_delete
      responses:
        '400':
          description: 'Entity type required error.'
          schema:
            $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.4/notes
    get:
      summary: Get Entity Single Note
      description: |
        An API client can use this endpoint to view a note for an entity.
      operationId: v3.4_notes_read
      responses:
        '400':
          description: 'Entity type required error.'
          schema:
            $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error404Generic'
              - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.4/notes
    parameters:
    - $ref: '#/components/parameters/NotesParamsV3_4/type'
    - $ref: '#/components/parameters/NotesParamsV3/note_id'
    - $ref: '#/components/parameters/NotesParamsV3_3/tvui_types'
    - $ref: '#/components/parameters/NotesParamsV3/type_id'
    patch:
      summary: Edit Entity Note
      description: |
        An API client can use this endpoint to modify a note for an entity.
      operationId: v3.4_notes_partial_update
      requestBody:
        $ref: '#/components/requestBodies/NotesBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '400':
          description: 'Invalid input error for note.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
            - $ref: '#/definitions/Error400PostNotes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.4/notes
  /api/v3.4/threatFeeds/:
    get:
      summary: Get Threatfeed List
      operationId: v3.4_threatFeeds_list
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already configured in
        the system.

        This endpoint is used to obtain the list of threat feeds (GET).

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters:
      - name: page
        in: query
        description: A page number within the paginated result set.
        required: false
        type: integer
      - name: page_size
        in: query
        description: Number of results to return per page.
        required: false
        type: integer
      - description: Which field to use when ordering the results.
        in: query
        name: ordering
        required: false
        type: string
        enum: 
        - 'name'
        - 'lastUpdatedBy'
        - 'lastUpdated'
        - 'category'
        - 'certainty'
        - 'expiration'
      - name: name
        type: string
        description: Filter by feed name.
        in: query
      - name: category
        type: string
        in: query
        description: Filter by feed category.
        enum:
        - cnc
        - lateral
        - exfil
      - name: certainty
        type: string
        in: query
        description: Filter by feed certainty.
        enum:
        - High
        - Medium
        - Low
      - name: expiration
        type: string
        in: query
        format: date-time
        description: Filter by feed expiration.
      - name: last_updated
        type: string
        in: query
        format: date-time
        description: Filter by feed last updated date.
      - name: last_updated_by
        type: string
        in: query
        description: Filter feeds by the user making the last update.
      - name: expiration_gte
        type: string
        in: query
        format: date-time
        description: Filter by feed expiration greater than the given date.
      - name: expiration_lte
        type: string
        in: query
        format: date-time
        description: Filter by feed expiration less than the given date.
      - name: last_updated_gte
        type: string
        in: query
        format: date-time
        description: Filter by feed latest update greater than the given date.
      - name: last_updated_lte
        type: string
        in: query
        format: date-time
        description: Filter by feed latest update less than the given date.
      responses:
        '422':
          description: The ordering param requested is invalid.
          schema:
            $ref: '#/definitions/Error422GetThreatfeeds'
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - type: object
              title: 'Success'
              properties:
                count:
                  type: integer
                  example: 1
                next:
                  format: uri
                  type: string
                  x-nullable: true
                  example: https://VECTRA_PORTAL_URL/api/v3.4/threatFeeds?page=2&page_size=1
                previous:
                  format: uri
                  type: string
                  x-nullable: true
                  example: null
                results:
                  items:
                    $ref: '#/definitions/ThreatFeedSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/threatFeeds
    post:
      summary: Create Threatfeed
      operationId: v3.4_threatFeeds_create
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already configured in
        the system.

        This endpoint is used to create a new threat Feed (POST).

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters:
      - name: data
        in: body
        required: true
        schema:
          type: object
          properties:
            threatFeed:
              type: object
              properties:
                name:
                  type: string
                  example: Example name
                defaults:
                  type: object
                  description: Dictionary describing threat feed default
                    values. 
                  properties:
                    indicatorType:
                      type: string
                      enum:
                      - Anonymization
                      - C2
                      - Exfiltration
                      - Malware Artifacts
                      - Watchlist
                      example: Anonymization
                    certainty:
                      type: string
                      enum:
                      - Low 
                      - Medium
                      - High
                      example: High
                    duration:
                      type: integer
                      example: 7
                    category:
                      type: string
                      enum:
                      - cnc
                      - exfil
                      - lateral
                      example: cnc
                  required:
                    - indicatorType
                    - certainty
                    - category
          required:
            - threatFeed
      responses:
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422PostThreatfeeds'
        '409':
          description: 'Conflict error.'
          schema:
            $ref: '#/definitions/Error409PostThreatfeeds'
        '400':
          description: 'JSON syntax error in request body.'
          schema:
            $ref: '#/definitions/Error400PostThreatfeeds'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        '201':
          description: ''
          schema:
            type: object
            properties:
              threatFeed:
                type: object
                properties:
                  name:
                    type: string
                    description: The name of the threat feed. 
                    example: Example feed
                  id:
                    type: string
                    description: The ID of the threat feed. 
                    example: 5ra34a3t78c6jk0b65494a84jrkc09c3
                  defaults:
                    type: object
                    description: Dictionary describing threat feed default
                      values. 
                    properties:
                      indicatorType:
                        type: string
                        description: Indicator Type of the threat feed. 
                        example: C2
                      certainty:
                        type: string
                        description: Certainty of the threat feed. 
                        example: High
                      duration:
                        type: integer
                        descrption: Duration of the threat feed until expiration. 
                        example: 90
                      category:
                        type: string
                        description: Threat Feed Category (lateral, cnc, exfil).
                        example: cnc
      tags:
      - v3.4/threatFeeds
    parameters: []
  /api/v3.4/threatFeeds/{feed_id}/:
    get:
      summary: Get Single Threatfeed
      operationId: v3.4_threatFeeds_read
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to obtain details of any threat feed (GET).

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500ThreatfeedFile'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - type: object
              title: 'Success'
              properties:
                id:
                  type: string
                  description: The ID of the threat feed. 
                  example: 5ra34a3t78c6jk0b65494a84jrkc09c3
                _rev:
                  type: string
                  description: The revision ID of the threat feed. 
                  example: 1-6dg0f0ab6a2b3hdj29814fh9307tt575f
                name:
                  type: string
                  description: The name of the threat feed. 
                  example: "Test Stix"
                lastUpdatedBy:
                  type: string
                  description: The user who updated the threat feed. 
                  example: "email@domain.com"
                version:
                  type: string
                  description: The version of the threat feed. 
                  example: 7.8-313
                uploadDate:
                  type: string
                  description: The creation date of the threat feed.
                  format: date-time
                lastUpdated:
                  type: string
                  description: The last update date of the threat feed. 
                  format: date-time
                uploadResults:
                  type: object
                  description: Dictionary describing the file uploaded 
                  example:
                    indicatorType: 'Malware Artifacts'
                    observableCount: 2
                    certainty: 'High'
                    expiration: '2025-05-04T14:52:22.024435+00:00'
                    category: 'cnc'
                type:
                  type: string
                  description: Threat Feed 
                  example: STIX
                defaults:
                  type: object
                  description: Dictionary describing threat feed default
                    values. 
                  properties:
                    indicatorType:
                      type: string
                      example: C2
                    certainty:
                      type: string
                      example: High
                    duration:
                      type: integer
                      example: 90
                    category:
                      type: string
                      example: cnc
                data:
                  type: object
                  description: The data from the STIX file. 
                  example: 
                    id: exampledata:Package-5ttle90e
                    version: 1.2
                    indicators: []
                    reports: []
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/threatFeeds
    post:
      summary: Add Threatfeed File
      operationId: v3.4_threatFeed_create
      consumes:
      - multipart/form-data
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to add a file to a threat feed (POST).

        **File Upload Specifications**

        There is a hard limit for file upload sizes of 5 MB at this time.
        If you receive a "413 Payload Too Large" error while uploading a file via POST,
        the file you are attempting to upload is too large. There is no limit on the
        amount of threatFeeds files you can upload, so we recommend splitting apart
        your STIX file into smaller parts and uploading each as its own threat feed so
        that each file is below the 5MB limit.
      parameters:
      - in: body
        name: data
        required: true
        schema:
          type: object
          properties:
            file:
              description: File to upload.
              type: file
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404PostThreatfeedId'
        '415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        '400':
          description: 'JSON syntax error in request body.'
          schema:
            $ref: '#/definitions/Error400PostThreatfeeds'
        '409':
          description: 'Conflict error.'
          schema:
            $ref: '#/definitions/Error409PostThreatfeeds'
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422PostThreatfeedId'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500ThreatfeedFile'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        '201':
          description: ''
          schema:
            type: object
            properties:
              threatFeed:
                type: object
                properties:
                  uploadResults:
                    title: Upload results
                    type: object
                    description: Dictionary describing the file uploaded 
                    properties:
                      indicatorType:
                        type: string
                        example: C2
                      certainty:
                        type: string
                        example: High
                      duration:
                        type: integer
                        example: 90
                      category:
                        type: string
                        example: cnc
      tags:
      - v3.4/threatFeeds
    patch:
      summary: Edit Threatfeed
      operationId: v3.4_threatFeeds_partial_update
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to update a threat feed (PATCH).

      parameters:
      - name: data
        in: body
        required: true
        schema:
          type: object
          properties:
            threatFeed:
              type: object
              properties:
                name:
                  type: string
                  example: Example name
                defaults:
                  description: Dictionary describing threat feed default
                    values. 
                  type: object
                  properties:
                    indicatorType:
                      type: string
                      enum:
                      - Anonymization
                      - C2
                      - Exfiltration
                      - Malware Artifacts
                      - Watchlist
                      example: Anonymization
                    certainty:
                      type: string
                      enum:
                      - Low
                      - Medium
                      - High
                      example: High
                    duration:
                      type: integer
                      example: 6
                    category:
                      type: string
                      enum:
                      - cnc
                      - exfil
                      - lateral
                      example: cnc
                  required:
                    - indicatorType
                    - certainty
                    - category
                upload:
                  type: object
                  properties:
                    replace_filename:
                      type: string
                      example: old_filename
                    filename:
                      type: string
                      example: new_filename
      responses:
        '409':
          description: 'Conflict error.'
          schema:
            $ref: '#/definitions/Error409PostThreatfeeds'
        '422':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error422PostThreatfeedId'
            - $ref: '#/definitions/Error422PatchThreatfeedId'
        '400':
          description: 'JSON syntax error in request body.'
          schema:
            $ref: '#/definitions/Error400PostThreatfeeds'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404PostThreatfeedId'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500ThreatfeedFile'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - type: object
              title: Success
              properties:
                threatFeed:
                  type: object
                  properties:
                    name:
                      type: string
                      example: Example feed
                    id:
                      type: string
                      example: 5ra34a3t78c6jk0b65494a84jrkc09c3
                    default:
                      title: default
                      type: object
                      description: Dictionary describing the file uploaded. 
                      properties:
                        indicatorType:
                          type: string
                          example: C2
                        certainty:
                          type: string
                          example: High
                        duration:
                          type: integer
                          example: 90
                        category:
                          type: string
                          example: cnc
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/threatFeeds
    delete:
      summary: Delete Threatfeed
      operationId: v3.4_threatFeeds_delete
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to delete a threat feed (DELETE).

      parameters: []
      responses:
        '409':
          description: 'Conflict error.'
          schema:
            $ref: '#/definitions/Error409PostThreatfeeds'
        '404':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error404PostThreatfeedId'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500ThreatfeedFile'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        '204':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                description: Success status of the deletion.
                example: success
      tags:
      - v3.4/threatFeeds
    parameters:
    - name: feed_id
      in: path
      required: true
      type: string
  /api/v3.4/threatFeeds/{feed_id}/file/:
    get:
      summary: Get Threatfeed File
      operationId: v3.4_threatFeeds_file_list
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to download a threat feed file (GET).

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters: []
      produces:
        - application/xml
      responses:
        '404':
          description: 'Not found error.'
          schema:
            - $ref: '#/definitions/Error404Threatfeed'
            - $ref: '#/definitions/Error404ThreatfeedFile'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'The file is returned in XML format for the successful response.'
          schema:
            oneOf:
            - type: string
              format: binary
              title: 'Success'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/threatFeeds
    delete:
      summary: Delete Threatfeed File
      operationId: v3.4_threatFeeds_file_delete
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to delete a threat feed file (DELETE).
      parameters: []
      responses:
        '409':
          description: 'Resource conflict error.'
          schema:
            $ref: '#/definitions/Error409ThreatfeedFileConflict'
        '404':
          description: 'Not found error.'
          schema:
            - $ref: '#/definitions/Error404Threatfeed'
            - $ref: '#/definitions/Error404ThreatfeedFile'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500ThreatfeedFile'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        '204':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                description: Success status of the deletion.
                example: success
      tags:
      - v3.4/threatFeeds
    parameters:
    - name: feed_id
      in: path
      required: true
      type: string
  /api/v3.4/unique_hosts_observed_monthly/:
    get:
      summary: Get Unique Hosts Observed Monthly
      operationId: v3.4_unique_hosts_observed_list
      description: |
        This endpoint has been deprecated. API users will be prompted to use v3.4/unique_hosts_observed.

        The unique hosts observed API can be used to view the count
        of all distinct hosts seen during a calendar month, for each
        month dating back one year.
      responses:
        ' 301':
          schema:
            type: object
            properties:
              message: 
                enum:
                  - "Moved permanently to /v3.4/unique_hosts_observed"
                type: string
                example: "Moved permanently to /v3.4/unique_hosts_observed"
        ' 200':
          description: 'This response is returned when the Vectra UI instance making the request does not have a network brain connection configured.'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        ' 401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        ' 403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        ' 413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        ' 429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        ' 500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        ' 503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        ' 504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
      tags:
      - v3.4/deprecated
    parameters: []
  /api/v3.4/unique_hosts_observed_monthly/audit/:
    get:
      summary: Get Unique Hosts Observed Monthly Audit
      operationId: v3.4_unique_hosts_observed_audit_list
      description: |
        This endpoint has been deprecated. API users will be prompted to use the v3.4 version of this endpoint.

        The unique hosts observed API can be used to view of all the
        distinct hosts seen during a calendar month, for each month
        dating back one year.
      responses:
        ' 301':
          schema:
            type: object
            properties:
              message: 
                enum:
                  - "Moved permanently to /v3.4/unique_hosts_observed/audit"
                type: string
                example: "Moved permanently to /v3.4/unique_hosts_observed/audit"
        ' 200':
          description: 'This response is returned when the Vectra UI instance making the request does not have a network brain connection configured.'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        ' 401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        ' 403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        ' 413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        ' 429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        ' 500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        ' 503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        ' 504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
      tags:
      - v3.4/deprecated
    parameters: []
  /api/v3.4/unique_hosts_observed/:
    get:
      summary: Get Unique Hosts Observed
      operationId: v3.4_unique_hosts_observed_timespan_get
      description: |
        The unique hosts observed timespan API can be used to view the count
        of all distinct hosts seen during the given timespan.
        The endpoint is only available to Restricted Admin clients for the default role permission settings.

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters:
        - $ref: '#/components/parameters/UniqueHostObservedListParamsV3_4/end'
        - $ref: '#/components/parameters/UniqueHostObservedListParamsV3_4/offset'
        - $ref: '#/components/parameters/UniqueHostObservedListParamsV3_4/start'
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400UniqueHostObserved'
              - $ref: '#/definitions/Error400UniqueHostsV3_4'
        '409':
          description: 'No host data error.'
          schema:
            $ref: '#/definitions/Error409UniqueHostsV3_4'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - title: Success
              $ref: '#/definitions/UniqueHostObservedSerializerV3_4'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/unique_hosts
    parameters: []
  /api/v3.4/unique_hosts_observed/audit/:
    get:
      summary: Get Unique Hosts Observed Audit
      operationId: v3.4_unique_hosts_observed_timespan_audit_get
      description: |
        The unique hosts observed timespan API can be used to view 
        all of the distinct hosts seen during the given timespan.
        The endpoint is only available to Restricted Admin clients for the default role permission settings.

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters:
        - $ref: '#/components/parameters/UniqueHostObservedAuditListParamsV3_4/page'
        - $ref: '#/components/parameters/UniqueHostObservedAuditListParamsV3_4/page_size'
        - $ref: '#/components/parameters/UniqueHostObservedListParamsV3_4/end'
        - $ref: '#/components/parameters/UniqueHostObservedListParamsV3_4/offset'
        - $ref: '#/components/parameters/UniqueHostObservedListParamsV3_4/start'
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400UniqueHostObserved'
              - $ref: '#/definitions/Error400UniqueHostsV3_4'
        '409':
          description: 'No host data error.'
          schema:
            $ref: '#/definitions/Error409UniqueHostsV3_4'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - type: object
              title: Success
              properties:
                count:
                  type: integer
                  example: 1
                next:
                  type: string
                  format: uri
                  x-nullable: true
                  example: null
                previous:
                  type: string
                  format: uri
                  x-nullable: true
                  example: null
                results:
                  type: array
                  items:
                    $ref: '#/definitions/UniqueHostAuditSerializerV3_4'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/unique_hosts
    parameters: []
  /api/v3.4/vectra-match/rules/upload/:
    get:
      summary: Get Match Rule Upload List
      description: |
        Get the list of the users uploads from the last 24 hours.

        * This endpoint requires a valid license for Vectra Match.    
      operationId: v3.4_vectra-match_rules_upload_list
      parameters: []
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchRuleUploadGet'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchRuleUploadGet'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              files:
                items:
                  $ref: '#/definitions/VectraMatchRulesUploadV3_3'
                type: array
            type: object
      tags:
      - v3.4/match
    post:
      summary: Create Match Rule Upload
      description: |
        Used to upload a new Vectra Match ruleset.

        Once a rules file has been uploaded, the API will return a uuid.
        This UUID will be used for managing the ruleset from that point forward,
        when interacting with the API.

        * Uploading a rules file requires a valid license for Vectra Match.
        * Audit logs will be emitted.    
      operationId: v3.4_vectra-match_rules_upload_post
      parameters:
      - name: data
        in: body
        required: true
        schema:
          type: object
          properties:
            file_name:
              type: string
              description: The file name for upload. 
              example: example_filename
            notes:
              type: string
              description: Notes on the file upload. 
              example: Example note
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchRuleUploadPost'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/VectraMatchRuleUploadPostV3_3'
      tags:
      - v3.4/match
  /api/v3.4/vectra-match/rules/upload/{uuid}/:
    get:
      summary: Get Match Single Rule Upload
      description: |
        Get the details of the upload.

        Use this endpoint to check that the uploaded file has successfully synced to the appliance.

        * Uploading a rules file requires a valid license for Vectra Match.
      operationId: v3.4_vectra-match_rules_upload_read
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            - $ref: '#/definitions/Error404URLNotFound'
            - $ref: '#/definitions/Error404MatchRuleUploadGet'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/VectraMatchRuleUploadV3_3'
      tags:
      - v3.4/match
    patch:
      summary: Edit Match Rule Upload
      description: |
        Mark the Match upload status as completed.

        After you have uploaded your file to the URL you received when you 
        created the upload, use this endpoint to mark the upload as completed. 
        This will start the sync of your file to the appliance.

        * Uploading a rules file requires a valid license for Vectra Match.
        * Audit logs will be emitted for using the POST and PATCH endpoints.
      operationId: v3.4_vectra-match_rules_upload_patch
      parameters:
      - name: data
        in: body
        required: true
        schema:
          type: object
          properties:
            upload_status:
              required: true
              type: string
              description: Current upload status
              example: completed
              enum:
              - completed
              - aborted
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404URLNotFound'
            - $ref: '#/definitions/Error404MatchRuleUploadPatch'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchRuleUploadPatch'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              upload_status:
                type: string
                description: Status of the file upload. 
                enum:
                - completed
                - aborted
            type: object
      tags:
      - v3.4/match
    parameters:
      - in: path
        name: uuid
        required: false
        type: string
        description: "UUID"
  /api/v3.4/health/external_connectors/:
    get:
      summary: Get Health External Connectors
      description: |
        Returns health information for external connectors. 
        Includes connection status, authentication status, lockdown status, and available error states. 
        Health information can be queried for the following external connectors:     
          * Active Directory and Lockdown
          * Azure AD Lockdown
          * AWS
          * Azure
          * Google Cloud
          * Reverse DNS Lookup
          * SIEM
          * vCenter
          * Windows Event Log Ingestion
          * Zscaler Private Access (ZPA)
        
        Health information is refreshed every 10 minutes. To get health information at the current time, use the ‘live’ query parameter. If refreshing health data takes more than 30 seconds, results will be stored and can be accessed by calling the endpoint without the ‘live’ parameter.
      operationId: v3.4_health_external_connectors_list
      parameters:
      - description: Filter on connector_type. Accepts comma-separated list.
        in: query
        name: connector_type
        enum:
        - active_directory
        - azure_ad_lockdown
        - aws
        - azure
        - google_cloud
        - reverse_lookup_dns
        - siem
        - vcenter
        - windows_event_log_ingestion
        - zscaler_private_access
        required: false
        type: string
      - description: Filter on data type. Accepts a comma-separated list.
        in: query
        name: data_type
        required: false
        enum:
        - connection_status
        - lockdown_status
        - auth_status
        - error_states
        type: string
      - description: If true, will refresh health information at the current time.
        in: query
        name: live
        required: false
        type: bool
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
              - $ref: '#/definitions/HealthExternalConnectorsV3_4'
              - $ref: '#/definitions/Response200HealthEvaluation'
      tags:
      - v3.4/health/external_connectors
  /api/v3.4/health/external_connectors/details/:
    get:
      summary: Get Health External Connectors Details
      description: |
        Returns health information details for external connectors. 
        Health details vary per connector. 
        Health details can be queried for the following external connectors:     
          * Active Directory and Lockdown
          * Azure AD Lockdown
          * AWS
          * Azure
          * Google Cloud
          * Reverse DNS Lookup
          * SIEM
          * vCenter
          * Windows Event Log Ingestion
          * Zscaler Private Access (ZPA)
        
        Health information is refreshed every 10 minutes. To get health information at the current time, use the ‘live’ query parameter. If refreshing health data takes more than 30 seconds, results will be stored and can be accessed by calling the endpoint without the ‘live’ parameter.
      operationId: v3.4_health_external_connectors_details_list
      parameters:
      - description: Filter on connector_type. Accepts comma-separated list.
        in: query
        name: connector_type
        enum:
        - active_directory
        - azure_ad_lockdown
        - aws
        - azure
        - google_cloud
        - reverse_lookup_dns
        - siem
        - vcenter
        - windows_event_log_ingestion
        - zscaler_private_access
        required: false
        type: string
      - description: If true, will refresh health information at the current time.
        in: query
        name: live
        required: false
        type: bool
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
              - $ref: '#/definitions/HealthExternalConnectorsDetailsV3_4'
              - $ref: '#/definitions/Response200HealthEvaluation'
      tags:
      - v3.4/health/external_connectors
  /api/v3.4/health/edr/details/:
    get:
      summary: Get Health EDR Details
      description: |
        Returns health information details for EDR connections. 
        Health details vary per EDR connection. 
        Health details can be queried for the following EDR connections:     
          * Host Lockdown
          * Microsoft Defender ATP
          * Carbon Black Response
          * Carbon Black Cloud
          * FireEye Endpoint Security
          * SentinelOne
          * Cybereason
          * CrowdStrike     

        Health information is refreshed every 10 minutes. To get health information at the current time, use the ‘live’ query parameter. If refreshing health data takes more than 30 seconds, results will be stored and can be accessed by calling the endpoint without the ‘live’ parameter.
      operationId: v3.4_health_edr_details_list
      parameters:
      - description: Filter on edr_type. Accepts comma-separated list. Available types - host_lockdown, windows_defender, carbon_black, cb_cloud, fireeye, sentinelone, cybereason, crowdstrike 
        in: query
        name: edr_type
        required: false
        type: string
      - description: If true, will refresh health information at the current time.
        in: query
        name: live
        required: false
        type: bool
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
              - $ref: '#/definitions/HealthEDRDetailsV3_4'
              - $ref: '#/definitions/Response200HealthEvaluation'
      tags:
      - v3.4/health/edr
  /api/v3.4/health/edr/:
    get:
      summary: Get Health EDR
      description: |
        Returns health information for EDR connections. 
        Includes connection status, authentication status, lockdown status, and available error states. 
        Health information can be queried for the following EDR connections:        
          * Host Lockdown
          * Microsoft Defender ATP
          * Carbon Black Response
          * Carbon Black Cloud
          * FireEye Endpoint Security
          * SentinelOne
          * Cybereason
          * CrowdStrike          

        Health information is refreshed every 10 minutes. To get health information at the current time, use the ‘live’ query parameter. If refreshing health data takes more than 30 seconds, results will be stored and can be accessed by calling the endpoint without the ‘live’ parameter.
      operationId: v3.4_health_edr_list
      parameters:
      - description: Filter on edr_type. Accepts comma-separated list.
        in: query
        name: edr_type
        enum:
        - host_lockdown
        - windows_defender
        - carbon_black
        - cb_cloud
        - fireeye
        - sentinelone
        - cybereason
        - crowdstrike
        required: false
        type: string
      - description: Filter on data type. Accepts a comma-separated list.
        in: query
        name: data_type
        enum:
        - connection_status
        - lockdown_status
        - auth_status
        - error_states
        required: false
        type: string
      - description: If true, will refresh health information at the current time.
        in: query
        name: live
        required: false
        type: bool
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/HealthEDRV3_4'
            - $ref: '#/definitions/Response200HealthEvaluation'
      tags:
      - v3.4/health/edr
  /api/v3.4/health/network_brain/ping/:
    get:
      summary: Get Health Ping
      description: |
        Returns the a ping if the network brain is connected. Includes the time taken to reach the network brain.

        Health information is refreshed every 10 minutes. To get health information at the current time, use the ‘live’ query parameter. If refreshing health data takes more than 30 seconds, results will be stored and can be accessed by calling the endpoint without the ‘live’ parameter.         
      operationId: v3.4_health_network_brain_ping_read
      parameters: []
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error500'
              - $ref: '#/definitions/Error500BrainPing'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
              - $ref: '#/definitions/HealthNetworkBrainPingV3_4'
              - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.4/health/network_brain
  /api/v3.4/notifications/destinations/:
    get:
      summary: List notification event destinations
      operationId: v3.4_notification_destination_list
      tags:
        - unreleased
    post:
      summary: Create a new notification event destinations
      operationId: v3.4_notification_destination_create
      tags:
        - unreleased
  /api/v3.4/notifications/destinations/{id}/:
    get:
      summary: Get a notification destination
      operationId: v3.4_notification_destination_list
      tags:
        - unreleased
    put:
      summary: Update a notification destination
      operationId: v3.4_notification_destination_list
      tags:
        - unreleased
    patch:
      summary: Partially update a new notification destination
      operationId: v3.4_notification_destination_update
      tags:
        - unreleased
    delete:
      summary: Delete a notification event destinations
      operationId: v3.4_notification_destination_delete
      tags:
        - unreleased
  /api/v3.3/accounts/:
    get:
      summary: Get Account List
      description: |
        Account objects contain information related to accounts observed in the environment.
      operationId: v3.3_accounts_list
      parameters:
        - $ref: '#/components/parameters/AccountsListParamsV3/ordering'
        - $ref: '#/components/parameters/AccountsListParamsV3/page'
        - $ref: '#/components/parameters/AccountsListParamsV3/page_size'
        - $ref: '#/components/parameters/AccountsListParamsV3/all'
        - $ref: '#/components/parameters/AccountsListParamsV3/c_score'
        - $ref: '#/components/parameters/AccountsListParamsV3/c_score_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/certainty'
        - $ref: '#/components/parameters/AccountsListParamsV3/certainty_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/exclude_fields'
        - $ref: '#/components/parameters/AccountsListParamsV3/fields'
        - $ref: '#/components/parameters/AccountsListParamsV3/first_seen'
        - $ref: '#/components/parameters/AccountsListParamsV3/id'
        - $ref: '#/components/parameters/AccountsListParamsV3/include_detection_summaries'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_detection_timestamp_lte'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_seen'
        - $ref: '#/components/parameters/AccountsListParamsV3/max_id'
        - $ref: '#/components/parameters/AccountsListParamsV3/min_id'
        - $ref: '#/components/parameters/AccountsListParamsV3/name'
        - $ref: '#/components/parameters/AccountsListParamsV3/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_category'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_level'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_level_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/state'
        - $ref: '#/components/parameters/AccountsListParamsV3/t_score'
        - $ref: '#/components/parameters/AccountsListParamsV3/t_score_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/tags'
        - $ref: '#/components/parameters/AccountsListParamsV3/threat'
        - $ref: '#/components/parameters/AccountsListParamsV3/threat_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/uid'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/AccountSerializerV3_3'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.3/accounts
    parameters: []
  /api/v3.3/accounts/{id}/:
    get:
      summary: Get Single Account
      description: |
        Account objects contain information related to accounts observed in the environment.
      operationId: v3.3_accounts_read
      parameters:
        - $ref: '#/components/parameters/AccountsReadParamsV3/exclude_fields'
        - $ref: '#/components/parameters/AccountsReadParamsV3/fields'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_access_history'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_detection_summaries'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_external'
        - $ref: '#/components/parameters/AccountsReadParamsV3/src_linked_account'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/SingleAccountSerializerV3_3'
      tags:
      - v3.3/accounts
    parameters:
    - in: path
      name: id
      required: true
      type: integer
  /api/v3.3/assignment_outcomes/:
    get:
      summary: Get Assignment Outcome List
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        This information includes but is not limited to:
          *	ID
          *	Title
          *	Category
      operationId: v3.3_assignment_outcomes_list
      parameters:
        - description: A page number within the paginated result set.
          in: query
          name: page
          required: false
          type: integer
          example: 1
          minimum: 1
        - description: Number of results to return per page.
          in: query
          name: page_size
          required: false
          type: integer
          minimum: 1
          example: 5
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/AssignmentOutcome'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.3/assignment_outcomes
    parameters: []
    post:
      summary: Create Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can create an outcome using this endpoint.
      operationId: v3.3_assignment_outcomes_create
      requestBody:
        $ref: '#/components/requestBodies/AssignmentOutcomePostBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignmentOutcomes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.3/assignment_outcomes
  /api/v3.3/assignment_outcomes/{id}/:
    delete:
      summary: Delete Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can delete an outcome using this endpoint.
      operationId: v3.3_assignment_outcomes_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400DeleteAssignmentOutcome'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.3/assignment_outcomes
    get:
      summary: Get Single Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        This information includes but is not limited to:
          *	ID
          *	Title
          *	Category
      operationId: v3.3_assignment_outcomes_read
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.3/assignment_outcomes
    parameters:
    - description: A unique integer value identifying this assignment outcome.
      in: path
      name: id
      required: true
      type: integer
      example: 1
      minimum: 1
    put:
      summary: Edit Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can modify an outcome using this endpoint.
      operationId: v3.3_assignment_outcomes_partial_update
      requestBody:
        $ref: '#/components/requestBodies/AssignmentOutcomePatchBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignmentOutcomes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.3/assignment_outcomes
  /api/v3.3/assignments/:
    get:
      summary: Get Assignment List
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.
        This information includes but is not limited to:
          * Assigned to user
          * Assigned by user
          * Date assigned
          * Date resolved
          * Events
          * Outcome
          * Account ID
          * Triaged detections
      operationId: v3.3_assignments_list
      parameters:
        - $ref: '#/components/parameters/AssignmentsListParamsV3/page'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/page_size'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/accounts'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/assignees'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/created_after'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/hosts'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/resolution'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/resolved'
      responses:
        '400':
          description: Invalid query parameter, parameter value, or authorization error.
          schema:
           oneOf:
            - $ref: '#/definitions/Error400GetAssignments'
            - $ref: '#/definitions/Error400InvalidParams'
            - $ref: '#/definitions/Error400InvalidParamValue'
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/Assignment'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.3/assignments
    parameters: []
    post:
      summary: Create Assignment
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.
        The creation of assignments is handled by this endpoint.
      operationId: v3.3_assignments_create
      requestBody:
        $ref: '#/components/requestBodies/AssignmentPostBodyV3_3'
      responses:
        '400':
          description: "Invalid input error."
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignments'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.3/assignments
  /api/v3.3/assignments/{id}/:
    delete:
      summary: Delete Assignment
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.
        This endpoint handles deleting a single assignment.
      operationId: v3.3_assignments_delete
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.3/assignments
    get:
      summary: Get Single Assignment
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.
        This information includes but is not limited to:
          * Assigned to user
          * Assigned by user
          * Date assigned
          * Date resolved
          * Events
          * Outcome
          * Account ID
          * Triaged detections
      operationId: v3.3_assignments_read
      responses:
        '400':
          description: 'Invalid query parameter.'
          schema:
            $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.3/assignments
    parameters:
      - $ref: "#/components/parameters/AssignmentsReadParamsV3/id"
    put:
      summary: Edit Assignment
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.

        An API client can modify the user and/or entity associated to an assignment using this endpoint.
      operationId: v3.3_assignments_update
      requestBody:
        $ref: '#/components/requestBodies/AssignmentPutBodyV3_3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: "Invalid input error."
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignments'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.3/assignments
  /api/v3.3/assignments/{id}/resolve/:
    parameters:
      - $ref: "#/components/parameters/AssignmentsReadParamsV3/id"
    put:
      summary: Resolve Assignment
      description: |
        Once completed, assignments can be resolved. Assignment resolutions provide a way to label and track
        the outcomes of assignments. Outcomes get recorded in the assignment's history.

        Outcome choices may include one of the following built-in assignment outcomes:
          * Benign True Positive
          * Malicious True Positive
          * False Positive

        Alternatively, users can choose to define their own Custom outcomes for reporting purposes.
      operationId: v3.3_assignments_resolve
      requestBody:
        $ref: '#/components/requestBodies/AssignmentsResolveBodyV3'
      responses:
        '409':
          description: 'Conflict error, assignment hsa already been resolved.'
          schema:
            $ref: '#/definitions/Error409ResolveAssignments'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: Invalid input error.
          schema:
            oneOf:
            - $ref: '#/definitions/Error400ResolveAssignmentsDetectionIDs'
            - $ref: '#/definitions/Error400ResolveAssignmentsOutcome'
            - $ref: '#/definitions/Error400ResolveAssignmentsTriageAs'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.3/assignments
  /api/v3.3/rules/:
    get:
      summary: Get Rule List
      tags:
      - v3.3/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint lists the existing Triage Rules in the system.
      operationId: v3.3_rules_list
      parameters:
        - $ref: '#/components/parameters/Common/ordering'
        - $ref: '#/components/parameters/Common/page'
        - $ref: '#/components/parameters/Common/page_size'
        - $ref: '#/components/parameters/RulesParamsV3/contains'
        - $ref: '#/components/parameters/RulesParamsV3/fields'
        - $ref: '#/components/parameters/RulesParamsV3/include_templates'
      responses:
        '404':
            description: The requested page does not exist. Reduce the requested page.
            schema:
              $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/RuleSerializerV3'
                type: array
    post:
      summary: Create Rule
      tags:
      - v3.3/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This path's POST method supports two different creation tasks
        depending on the request body.

        **Task A**

        When specifying a new triage category in the request body
        without a detection list, this endpoint creates new Triage Rules.

        The following format is required for source_conditions
        and additional_conditions in the request body:

        The format for Triage rules is based on AND/OR logic,
        making them more flexible and customizable to your specific situation.
        Both 'source_conditions' and 'additional_conditions' are now
        saved as JSON blobs which represents a tree-like structure.
        Each tree node is represented in the following format:

        ```
        {operator: operand}
        ```

        Where "operator" is any of the following:

        ```
        For non-leaf nodes: 'AND' or 'OR'
        For leaf nodes: 'ANY_OF' or 'NONE_OF'
        ```

        The format for "operand" also depends on the type of node.

        For non-leaf nodes, use a list of children tree nodes of the form:

        ```
        [{operator: operand}, {operator: operand}, ...]
        ```

        For leaf nodes, use a dictionary of the form:

        ```
        {
          'field': <FIELD NAME>,
          'values': [{'value': [<VALUE>]}],
          'group': [{'value': [<GROUP ID>]}]
        }
        ```

        Stipulations on the format of the top-level tree structure
        is that the top-level operator must be an 'OR' node, with
        a single 'AND' node as the only child. The 'AND' node may have an arbitrary number
        of leaf node children. All valid Triage rules will look as follows:

        ```
        {
          'OR': [
            {
              'AND': [
                <LEAF NODE 1>,
                <LEAF NODE 2>,
                ...
                <LEAF NODE N>,
              ]
            }
          ]
        }
        ```

        Note 'source_conditions' and 'additional_conditions' have different fields
        that can be used in their leaf nodes. For 'source_conditions', the following
        fields are valid: ip, host, account, sensor. The fields 'ip' and 'host'
        also support triaging on groups, meaning that an IP or a host leaf node can
        be given an IP Group or Host Group ID, and the Triage rule will apply to
        every IP/host in the specified group. For 'additional_conditions', the following
        fields are valid: remote1_ip, remote1_proto, remote1_port, remote1_dns, remote2_ip,
        remote2_proto, remote2_port, remote2_dns, account, named_pipe, uuid,
        identity, share, extensions, rdp client name, rdp client token, keyboard name.
        The fields 'remote1_ip', 'remote2_ip', 'remote1_dns', 'remote2_dns' support
        triaging on groups. Either 'source_conditions' or 'additional_conditions' may
        be null. Setting source_conditions to null implies that this Triage rule with
        apply to All Hosts.

        **Task B**

        The POST Triage Rules endpoint can be used with a
        request body specifying detection ids and a triage category
        to filter a set of detections under the chosen triage category
      operationId: v3.3_rules_create
      parameters:
      - in: body
        name: data
        required: true
        schema:
          oneOf:
          - title: Task A
            description: The request schema for Task A.
            $ref: '#/definitions/RuleRequestBodyV3'
          - type: object
            title: Task B
            description: The request schema for Task B.
            properties:
              detectionIdList:
                description: Detections ids to add to triage rule filter.
                items:
                  type: integer
                  example: 1
                type: array
              triage_category:
                type: string
                example: Benign Detection
                description: Custom Triage label used to categorize specified detections.
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400JsonParse'
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error422PostRulesInvalidField'
              - $ref: '#/definitions/Error422PostRulesConditionsField'
              - $ref: '#/definitions/Error422PostRulesDetectionList'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            oneOf:
            - type: object
              title: Task A
              description: The response for Task A.
              properties:
                id:
                  type: integer
                  description: Rule ID. 
                  example: 1
                _meta:
                  type: object
                  properties:
                    level:
                      type: string
                      description: Success status of operation. 
                      example: Success
                    message:
                      type: string
                      description: Message of success status of operation. 
                      example: "Successfully created triage filter"
            - type: object
              title: Task B
              description: The response for Task B.
              properties:
                ids:
                  type: array
                  items:
                    type: integer
                    example: 1
                  description: Rule IDs. 
                _meta:
                  type: object
                  properties:
                    level:
                      type: string
                      description: Success status of operation. 
                      example: Success
                    message:
                      type: string
                      description: Message of success status of operation. 
                      example: "Successfully created triage filter"
    delete:
      summary: Delete Detections Rule
      tags:
      - v3.3/rules
      description: |
        The DELETE Triage Rules endpoint can be used with the following
        request body to remove triage filters for a set of detections.
      operationId: v3.3_detection_rules_delete
      parameters:
      - in: body
        name: data
        required: true
        schema:
          type: object
          properties:
            detectionIdList:
              description: Detections ids to remove triage rule filters.
              items:
                type: integer
                example: 1
              type: array
      responses:
        '422':
          description: Invalid input for detectionIdList.
          schema:
            $ref: '#/definitions/Error422DeleteRulesDetectionList'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
  /api/v3.3/rules/{rule_id}/:
    parameters:
    - in: path
      name: rule_id
      required: true
      type: integer
      description: The rule ID. 
    get:
      summary: Get Single Rule
      tags:
      - v3.3/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint lists a single Triage Rules in the system.
      operationId: v3_3_rule_read
      parameters:
      - description: Which field to use when ordering the results.
        in: query
        name: fields
        required: false
        type: string
        enum:
        - id
        - url
        - description
        - enabled
        - created_timestamp
        - last_timestamp
        - is_whitelist
        - priority
        - active_detections
        - total detections
        - template
        - additional_conditions
        - source_condition
        - detection
        - detection_category
        - triage_category
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: Invalid query parameter requested.
          schema:
           $ref: '#/definitions/Error400InvalidParams'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/RuleSerializerV3'
    put:
      summary: Edit Rule
      tags:
      - v3.3/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint manages updating Triage Rules.

        The following format is required for source_conditions
        and additional_conditions in the request body:

        The format for Triage rules is based on AND/OR logic,
        making them more flexible and customizable to your specific situation.
        Both 'source_conditions' and 'additional_conditions' are now
        saved as JSON blobs which represents a tree-like structure.
        Each tree node is represented in the following format:

        ```
        {operator: operand}
        ```

        Where "operator" is any of the following:

        ```
        For non-leaf nodes: 'AND' or 'OR'
        For leaf nodes: 'ANY_OF' or 'NONE_OF'
        ```

        The format for "operand" also depends on the type of node.

        For non-leaf nodes, use a list of children tree nodes of the form:

        ```
        [{operator: operand}, {operator: operand}, ...]
        ```

        For leaf nodes, use a dictionary of the form:

        ```
        {
          'field': <FIELD NAME>,
          'values': [{'value': [<VALUE>]}],
          'group': [{'value': [<GROUP ID>]}]
        }
        ```

        Stipulations on the format of the top-level tree structure
        is that the top-level operator must be an 'OR' node, with
        a single 'AND' node as the only child. The 'AND' node may have an arbitrary number
        of leaf node children. All valid Triage rules will look as follows:

        ```
        {
          'OR': [
            {
              'AND': [
                <LEAF NODE 1>,
                <LEAF NODE 2>,
                ...
                <LEAF NODE N>,
              ]
            }
          ]
        }
        ```

        Note 'source_conditions' and 'additional_conditions' have different fields
        that can be used in their leaf nodes. For 'source_conditions', the following
        fields are valid: ip, host, account, sensor. The fields 'ip' and 'host'
        also support triaging on groups, meaning that an IP or a host leaf node can
        be given an IP Group or Host Group ID, and the Triage rule will apply to
        every IP/host in the specified group. For 'additional_conditions', the following
        fields are valid: remote1_ip, remote1_proto, remote1_port, remote1_dns, remote2_ip,
        remote2_proto, remote2_port, remote2_dns, account, named_pipe, uuid,
        identity, share, extensions, rdp client name, rdp client token, keyboard name.
        The fields 'remote1_ip', 'remote2_ip', 'remote1_dns', 'remote2_dns' support
        triaging on groups. Either 'source_conditions' or 'additional_conditions' may
        be null. Setting source_conditions to null implies that this Triage rule with
        apply to All Hosts.
      operationId: v3.3_rule_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          $ref: '#/definitions/RuleRequestBodyV3'
      responses:
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error422PostRulesInvalidField'
              - $ref: '#/definitions/Error422PostRulesConditionsField'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Rules'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              data:
                $ref: '#/definitions/RuleSerializerV3'
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success status of operation. 
                    example: Success
                  message:
                    type: string
                    description: Message of success status of operation. 
                    example: "Successfully edited triage filter"
    delete:
      summary: Delete Rule
      tags:
      - v3.3/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint manages deleting rules from the system.
      operationId: v3.3_rule_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
        '400':
          description: Invalid query parameter requested.
          schema:
           $ref: '#/definitions/Error400InvalidParams'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
  /api/v3.3/detections/:
    get:
      summary: Get Detection List
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Detections are grouped into one of the following categories:
        | Detection Category  | URL |
        | -------- | ------- |
        | Command & Control  | /detections?detection_category=command    |
        | Botnet | /detections?detection_category=botnet     |
        | Reconnaissance    | /detections?detection_category=reconnaissance    |
        | Lateral Movement    | /detections?detection_category=lateral    |
        | Exfiltration    | /detections?detection_category=exfiltration    |
        | Info    | /detections?detection_category=info    |

        Please note that AWS imposes a 30 second timeout window for all requests. As a result, this endpoint may timeout when trying to query large amounts of complex detection data. If experiencing 504 responses, please try to adjust the number of detections returned by using the 'page_size' query parameter.

        The API query performs partial word match. For example, you can use /detections?
        detection_category=recon to query all Reconnaissance category detections.

      operationId: v3.3_detections_list
      parameters:
      - $ref: '#/components/parameters/DetectionsParamsV3/ordering'
      - $ref: '#/components/parameters/DetectionsParamsV3/page'
      - $ref: '#/components/parameters/DetectionsParamsV3/page_size'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/canonicalize'
      - $ref: '#/components/parameters/DetectionsParamsV3/category'
      - $ref: '#/components/parameters/DetectionsParamsV3/certainty'
      - $ref: '#/components/parameters/DetectionsParamsV3/certainty_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/created_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/created_timestamp_lte'
      - $ref: '#/components/parameters/DetectionsParamsV3/c_score'
      - $ref: '#/components/parameters/DetectionsParamsV3/c_score_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/description'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection_type'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection_category'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/entity_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/exclude_fields'
      - $ref: '#/components/parameters/DetectionsParamsV3/fields'
      - $ref: '#/components/parameters/DetectionsParamsV3/host_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/id'
      - $ref: '#/components/parameters/DetectionsParamsV3/is_targeting_key_asset'
      - $ref: '#/components/parameters/DetectionsParamsV3/is_triaged'
      - $ref: '#/components/parameters/DetectionsParamsV3/last_timestamp'
      - $ref: '#/components/parameters/DetectionsParamsV3/last_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/last_timestamp_lte'
      - $ref: '#/components/parameters/DetectionsParamsV3/min_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/max_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/note_modified_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/src_account'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/src_account_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/src_ip'
      - $ref: '#/components/parameters/DetectionsParamsV3/state'
      - $ref: '#/components/parameters/DetectionsParamsV3/tags'
      - $ref: '#/components/parameters/DetectionsParamsV3/threat'
      - $ref: '#/components/parameters/DetectionsParamsV3/threat_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3.3/type'
      - $ref: '#/components/parameters/DetectionsParamsV3/t_score'
      - $ref: '#/components/parameters/DetectionsParamsV3/t_score_gte'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3.3/detections?page=3&page_size=1
              previous:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3.4/detections?page=1&page_size=1
              results:
                items:
                  $ref: '#/definitions/DetectionSerializerV3_3'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.3/detections
    parameters: []
    patch:
      summary: Mark Detections as Fixed
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Marking a detection as Fixed indicates that some remedial action was taken based upon the detection.
        Threat and Certainty scores will both be 0 once a detection has been marked as fixed.
      operationId: v3.3_detections_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            detectionIdList:
              description: Detections ids to mark/unmark as fixed.
              items:
                type: integer
                example: 1
              type: array
            mark_as_fixed:
              description: Flag to mark/unmark as fixed.
              type: boolean
              example: true 
          required:
          - detectionIdList
          - mark_as_fixed
          type: object
      responses:
        '404':
          description: Not found error.
          schema:
            $ref: '#/definitions/Error404PatchDetections'
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422PatchDetections'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success flag for patch.
                    example: Success
                  message:
                    type: string
                    description: Operation message.
                    example: "Successfully marked detections"
      tags:
      - v3.3/detections
  /api/v3.3/detections/{id}/:
    get:
      summary: Get Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Detections are grouped into one of the following categories:
        | Detection Category  | URL |
        | -------- | ------- |
        | Command & Control  | /detections?detection_category=command    |
        | Botnet | /detections?detection_category=botnet     |
        | Reconnaissance    | /detections?detection_category=reconnaissance    |
        | Lateral Movement    | /detections?detection_category=lateral    |
        | Exfiltration    | /detections?detection_category=exfiltration    |
        | Info    | /detections?detection_category=info    |
        
      operationId: v3.3_detections_read
      parameters:
      - description: Fields to include in the response object.
        enum:
        - id
        - url
        - detection_url
        - category
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - t_score
        - c_score
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - targets_key_asset
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        - campaign_summaries
        - grouped_details
        - summary
        - is_triaged
        - src_linked_account
        in: query
        name: fields
        required: false
        type: string
      - description: Fields to exclude in the response object.
        enum:
        - id
        - url
        - detection_url
        - category
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - t_score
        - c_score
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - targets_key_asset
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        in: query
        name: exclude_fields
        required: false
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/DetectionSerializerV3_3'
      tags:
      - v3.3/detections
    parameters:
    - in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Edit Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Marking a detection as Fixed indicates that some remedial action was taken based upon the detection.
        Threat and Certainty scores will both be 0 once a detection has been marked as fixed.
      operationId: v3.3_detection_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            mark_as_fixed:
              description: Flag to mark/unmark as fixed.
              type: boolean
              example: true
            note:
              description: Note to overwrite.
              type: string
              example: New note
            note_id:
              description: Note id to overwrite.
              type: integer
              example: 1
            triageAs:
              description: Label for one-time triage of a detection.
              type: string
              example: Benign Detection
          type: object
      responses:
        '422':
          description: Returned when request body is missing.
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: 'Returned when a triage filter has been created for the detection.'
        '200':
          description: 'Returned when a detection has been marked as fixed or a detection note has been updated.'
      tags:
      - v3.3/detections
  /api/v3.3/detections/{id}/pcap/:
    get:
      summary: Get Detection PCAP
      description: |
        Vectra API supports download of PCAP for a particular detection.

        The download of PCAP via API is subject to RBAC rules just like UI access.
        If a user's role does not permit viewing PCAP information,
        they will not be able to access PCAP via API as well.
      operationId: v3.3_detections_pcap_read
      parameters: []
      produces:
        - application/octet-stream
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - type: file
              title: Success
              description: The PCAP file will be downloaded for succesful requests.
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/detections
    parameters:
    - description: A unique integer value identifying this detection.
      in: path
      name: id
      required: true
      type: integer
  /api/v3.3/entities/:
    get:
      summary: Get Entity List
      description: |
        Entities is an overarching term to cover various types of models, including Accounts and Hosts.
        Entities are returned with an entity type, indicating what type of entity it is,
        along with urgency, importance, and fields from the original model.
      operationId: v3.3_entities_list
      parameters:
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/ordering'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/page'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/page_size'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/entity_type'
        - $ref: '#/components/parameters/EntitiesListParamsV3_3/exclude_fields'
        - $ref: '#/components/parameters/EntitiesListParamsV3_3/fields'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/id'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/is_prioritized'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_3/last_modified_timestamp_gte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_3/last_modified_timestamp_lte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/name'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_3/last_detection_timestamp_lte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/state'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/tags'
        - $ref: '#/components/parameters/EntitiesListParamsV3_3/type'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400RepeatedType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/EntityListSerializerV3_3'
                type: array
      tags:
      - v3.3/entities
    parameters: []
  /api/v3.3/entities/{id}/:
    get:
      summary: Get Single Entity
      description: |
        Entities is an overarching term to cover various types of models, including Accounts and Hosts.
        Entities are returned with an entity type, indicating what type of entity it is,
        along with urgency, importance, and fields from the original model.
      operationId: v3.3_entities_read
      parameters:
      - $ref: '#/components/parameters/EntitiesReadParamsV3_3/type'
      - $ref: '#/components/parameters/EntitiesReadParamsV3_3/entity_type'
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/EntityDetailSerializerV3_3'
      tags:
      - v3.3/entities
    parameters:
    - in: path
      name: id
      required: true
      type: integer
  /api/v3.3/events/account_detection/:
    get:
      summary: Get Account Detection Events
      description: 'This endpoint has been deprecated. Data is available via /events/detections'
      operationId: v3.3_events_account_detection_list
      parameters: []
      responses:
        '410':
          description: Deprecated. Data is available via /events/detections
          schema:
            type: object
            properties:
              message:
                type: string
                enum:
                - Deprecated. Data is available via /events/detections
      tags:
      - v3.3/deprecated
      - v3.4/deprecated
    parameters: []
  /api/v3.3/events/account_scoring/:
    get:
      summary: Get Account Scoring Events
      description: 'This endpoint has been deprecated. Data is available via /events/entity_scoring'
      operationId: v3.3_events_account_scoring_list
      parameters: []
      responses:
        '410':
          description: Deprecated. Data is available via /events/entity_scoring
          schema:
            type: object
            properties:
              message:
                type: string
                enum:
                - Deprecated. Data is available via /events/entity_scoring
      tags:
      - v3.3/deprecated
      - v3.4/deprecated
    parameters: []
  /api/v3.3/events/audits/:
    get:
      summary: Get Audit Log Events
      description: |
        Audit Log Events are generated when a user action is performed on the system. Audit Log Event are
        sequential and can be used to create an audit trail of user activity on your system.

        > NOTE: Audit events are persisted for 1 year.

        Example URL to retrieve audit events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.3/events/audits?from=101`.
      operationId: v3.3_events_audits_list
      parameters:
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_timestamp_lte'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/from'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/user_id'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_object'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_action'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/ordering'
      responses:
        '400':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/AuditEventSerializerV3'
      tags:
      - v3.3/events
    parameters: []
  /api/v3.3/events/detections/:
    get:
      summary: Get Detection Events
      description: |
        Detection Events are generated upon initial detection and for each update of the detection.

        Example URL to retrieve detection events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.3/events/detections?from=101`.
      operationId: v3.3_events_detections_list
      parameters:
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/account_uid'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/event_timestamp_lte'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/entity_type'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/detection_id'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/from'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/id'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/include_info_category'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/include_triaged'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/limit'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/ordering'
        - $ref: '#/components/parameters/EventsDetectionsListParamsV3_3/type'
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400RepeatedType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                items:
                  $ref: '#/definitions/DetectionEventSerializerV3_3'
                type: array
      tags:
      - v3.3/events
    parameters: []
  /api/v3.3/events/entity_scoring/:
    get:
      summary: Get Entity Scoring Events
      description: |
        Entity Scoring Events are generated when an entity score is changed, which occurs upon initial threat
        detection, discovery of additional detections, and updates to any discovered detections. The entity
        score is reduced over time if the underlying detection behavior subsides, either because of user
        intervention or because the account has left the environment.

        Host scoring events prior to May 2023 will have score_decrease enabled to false, so that all scoring
        events will be returned. Host scoring events starting May 2023 will be able to be filtered by the
        include_score_decreases query param.

        NOTE: You must include the type query param in your request to specify if you would like "account" or
        "host" entity scoring events

        Example URL to retrieve entity scoring events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.3/events/entity_scoring?from=101`.
      operationId: v3.3_events_entity_scoring_list
      parameters:
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/event_timestamp_lte'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/from'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/include_score_decreases'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/entity_type'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/type'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/limit'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_3/ordering'
      responses:
        '404':
          description: 'Not found error.'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
              - $ref: '#/definitions/Error400RepeatedType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/EntityScoringEventSerializerV3_3'
      tags:
      - v3.3/events
    parameters: []
  /api/v3.3/groups/:
    get:
      summary: Get Group List
      description: |
        The groups API can retrieve a listing of groups that are defined on the system.

        Version 3.3 of groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        account/IP/host/domain groups, but also create, modify, or delete them.

        Note that Dynamic Groups with large amounts of users may cause the endpoint to time out. To avoid
        this, please set the “include_members” query param to False.
      operationId: v3.3_groups_list
      parameters:
      - $ref: '#/components/parameters/GroupsListParamsV3_2/ordering'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/page'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/page_size'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/account_ids'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/account_names'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/description'
      - $ref: '#/components/parameters/GroupsListParamsV3_4/domains'
      - $ref: '#/components/parameters/GroupsListParamsV3_4/host_ids'
      - $ref: '#/components/parameters/GroupsListParamsV3_4/host_names'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/importance'
      - $ref: '#/components/parameters/GroupsListParamsV3_4/ips'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/last_modified_by'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/last_modified_timestamp'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/name'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/type'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/GroupSerializerV3_2'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.3/groups
    parameters: []
    post:
      summary: Create Group
      description: |
        The groups API can retrieve a listing of groups that are defined on the system.

        Version 3.3 of groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        account/IP/host/domain groups, but also create, modify, or delete them.

        Use account uids to assign Account Group membership. Use host ids to assign host group membership.
      operationId: v3.3_groups_create
      requestBody:
        $ref: '#/components/requestBodies/GroupPostBodyV3_2'
      parameters:
      - in: body
        name: data
        required: true
      responses:
        '409':
          description: 'Name conflict error.'
          schema:
            $ref: '#/definitions/Error409PostGroups'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400InvalidJson'
            - $ref: '#/definitions/Error400InvalidBodyParam'
        '415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error422GroupsInvalidType'
            - $ref: '#/definitions/Error422GroupsMissingBodyParam'
            - $ref: '#/definitions/Error422GroupsBody'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            properties:
              group:
                type: object
                properties:
                  id:
                    type: integer
                    example: 1
      tags:
      - v3.3/groups
  /api/v3.3/groups/{id}/:
    delete:
      summary: Delete Group
      description: |
        The groups API can retrieve a listing of groups that are defined on the system.

        Version 3.3 of groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        account/IP/host/domain groups, but also create, modify, or delete them.
      operationId: v3.3_groups_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422GroupsDelete'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.3/groups
    get:
      summary: Get Single Group
      description: |
        The groups API can retrieve a listing of groups that are defined on the system.

        Version 3.2 of groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        account/IP/host/domain groups, but also create, modify, or delete them.

        Note that Dynamic Groups with large amounts of users may cause the endpoint to time out. To avoid
        this, please set the “include_members” query param to False.
      operationId: v3.3_groups_read
      parameters:
      - description: Flag to include members in the response object. Regex groups may return many members.
            By default this is true.
        in: query
        name: include_members
        required: false
        type: boolean
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/GroupSerializerV3_2'
      tags:
      - v3.3/groups
    parameters:
    - description: A unique integer value identifying this group collection.
      in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Edit Group
      description: |
        The groups API can retrieve a listing of groups that are defined on the system.

        Version 3.3 of groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        account/IP/host/domain groups, but also create, modify, or delete them.

        When using the default PATCH functionality to modify the members, a complete new list must be included. For
        example, if a group already contains accounts "acct1@test.com", and "acct2@test.com", and the group should be
        modified to include account "acct5@test.com", then "acct5@test.com" should be added to the list, the members
        field of the PATCH request should be "acct1@test.com","acct2@test.com","acct5@test.com".

        Alternatively, the "membership_action" query parameter can be passed in with a value of "replace", "append", or
        "remove". The "append" and "remove" values will only affect members listed in the request body; if a user wants to
        add or remove account "acct1@test.com" for a group, then the user can pass the members field of
        "acct1@test.com" in the request body with the appropriate value of "membership_action". The "replace" value will
        perform the default PATCH behavior.
      operationId: v3.3_groups_partial_update
      requestBody:
        $ref: '#/components/requestBodies/GroupPatchBodyV3_2'
      parameters:
      - in: body
        name: data
        required: true
      - description: Flag to specify the membership update to be performed. If this
          is not specified, the default action is membership replacement.
        enum:
        - remove
        - replace
        - append
        in: query
        name: membership_action
        required: false
        type: string
      responses:
        '409':
          description: 'Name conflict error.'
          schema:
            $ref: '#/definitions/Error409PostGroups'
        '415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaTypeDetail'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400JsonParse'
              - $ref: '#/definitions/Error400InvalidBodyParam'
              - $ref: '#/definitions/Error400GroupsPatchTypeChange'
              - $ref: '#/definitions/Error400InvalidJson'
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error422GroupsBody'
            - $ref: '#/definitions/Error422GroupsInvalidType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/GroupSerializerV3_2'
      tags:
      - v3.3/groups
  /api/v3.3/health/:
    get:
      summary: Get Health
      description: |
        The health API can retrieve a listing of system health information.

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      operationId: v3.3_health_read
      parameters:
        - $ref: '#/components/parameters/HealthParamsV3_3/cache'
        - $ref: '#/components/parameters/HealthParamsV3_3/vlans'
      # - default: true
      #   description: Flag to used cached data. If set to true, the response will include
      #     an 'updated_at' property with the time at which the health check was performed.
      #     Cached values will be no older than five minutes. Setting this to false
      #     will force a new health check.
      #   in: query
      #   name: cache
      #   required: false
      #   type: boolean
      # - default: true
      #   description: Flag to include or omit the list of VLANs observed from the returned
      #     data. Large environments with many vlans can result in slow performance
      #     from /health.
      #   in: query
      #   name: vlans
      #   required: false
      #   type: boolean
      responses:
        '400':
          description: 'Invalid health check error.'
          schema:
            $ref: '#/definitions/Error400InvalidHealthCheck'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/HealthSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/health
    parameters: []
  /api/v3.3/health/{check_type}/:
    get:
      summary: Get Health Check
      description: |
        The health API can retrieve a listing of system health information.

        This endpoint returns health information for a specific check type.

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      operationId: v3.3_health_read_check_type
      parameters:
        - $ref: '#/components/parameters/HealthParamsV3_3/cache'
        - $ref: '#/components/parameters/HealthParamsV3_3/vlans'
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
              - type: object
                title: CPU
                properties:
                  cpu:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/cpu'
              - type: object
                title: Disk
                properties:
                  disk:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/disk'
              - type: object
                title: Network
                properties:
                  network:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/network'
              - type: object
                title: Power
                properties:
                  power:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/power'
              - type: object
                title: Sensor
                properties:
                  sensor:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/sensors'
              - type: object
                title: System
                properties:
                  system:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/system'
              - type: object
                title: Host ID
                properties:
                  hostid:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/hostid'
              - type: object
                title: Connectivity
                properties:
                  connectivity:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/connectivity'
              - type: object
                title: Traffic drop
                properties:
                  trafficdrop:
                    $ref: '#/definitions/HealthSerializerV3_3/properties/trafficdrop'
              - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/health
    parameters:
    - description: Filter on the type of health check.
      enum:
      - cpu
      - disk
      - memory
      - network
      - power
      - sensors
      - system
      - hostid
      - connectivity
      - trafficdrop
      in: path
      name: check_type
      required: true
      type: string
  /api/v3.3/hosts/:
    get:
      summary: Get Host List
      description: |
        Host information includes data that correlates the Host data to detected security events.
        This information includes but is not limited to:
          *	Hostname
          *	IP address
          *	Threat score
          *	Certainty score

        API responses may vary depending on product subscriptions (Network, AWS, M365).

        Note: For those experiencing 504 responses from the /hosts API, the all_active query parameter set to 'true' can improve performance and alleviate timeouts. Reducing the page_size can help with timeouts as well.
      operationId: v3.3_hosts_list
      parameters:
        - $ref: '#/components/parameters/HostsListParamsV3_3/ordering'
        - $ref: '#/components/parameters/HostsListParamsV3_3/page'
        - $ref: '#/components/parameters/HostsListParamsV3_3/page_size'
        - $ref: '#/components/parameters/HostsListParamsV3_3/active_traffic'
        - $ref: '#/components/parameters/HostsListParamsV3_3/all'
        - $ref: '#/components/parameters/HostsListParamsV3_3/all_active'
        - $ref: '#/components/parameters/HostsListParamsV3_3/c_score'
        - $ref: '#/components/parameters/HostsListParamsV3_3/c_score_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/certainty'
        - $ref: '#/components/parameters/HostsListParamsV3_3/certainty_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/exclude_fields'
        - $ref: '#/components/parameters/HostsListParamsV3_3/fields'
        - $ref: '#/components/parameters/HostsListParamsV3_3/has_active_traffic'
        - $ref: '#/components/parameters/HostsListParamsV3_3/include_detection_summaries'
        - $ref: '#/components/parameters/HostsListParamsV3_3/is_key_asset'
        - $ref: '#/components/parameters/HostsListParamsV3_3/is_targeting_key_asset'
        - $ref: '#/components/parameters/HostsListParamsV3_3/key_asset'
        - $ref: '#/components/parameters/HostsListParamsV3_3/last_detection_timestamp'
        - $ref: '#/components/parameters/HostsListParamsV3_3/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/last_detection_timestamp_lte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/last_source'
        - $ref: '#/components/parameters/HostsListParamsV3_3/mac_address'
        - $ref: '#/components/parameters/HostsListParamsV3_3/max_id'
        - $ref: '#/components/parameters/HostsListParamsV3_3/min_id'
        - $ref: '#/components/parameters/HostsListParamsV3_3/name'
        - $ref: '#/components/parameters/HostsListParamsV3_3/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/privilege_category'
        - $ref: '#/components/parameters/HostsListParamsV3_3/privilege_level'
        - $ref: '#/components/parameters/HostsListParamsV3_3/privilege_level_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/state'
        - $ref: '#/components/parameters/HostsListParamsV3_3/t_score'
        - $ref: '#/components/parameters/HostsListParamsV3_3/t_score_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/tags'
        - $ref: '#/components/parameters/HostsListParamsV3_3/targets_key_asset'
        - $ref: '#/components/parameters/HostsListParamsV3_3/threat'
        - $ref: '#/components/parameters/HostsListParamsV3_3/threat_gte'
        - $ref: '#/components/parameters/HostsListParamsV3_3/uuid'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/HostSerializerV3_3'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.3/hosts
    parameters: []
  /api/v3.3/hosts/{id}/:
    get:
      summary: Get Single Host
      description: |
        Host information includes data that correlates the Host data to detected security events.
        This information includes but is not limited to:
          *	Hostname
          *	IP address
          *	Threat score
          *	Certainty score

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      operationId: v3.3_hosts_read
      parameters:
        - $ref: '#/components/parameters/HostsReadParamsV3_3/exclude_fields'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/fields'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_access_history'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_edrs'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_external'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_detection_summaries'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_host_roles'
        - $ref: '#/components/parameters/HostsReadParamsV3_3/include_ldap'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'   
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/SingleHostSerializerV3_3'
      tags:
      - v3.3/hosts
    parameters:
    - in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Edit Host
      description: |

        The PATCH operation is used to set or remove the key asset flag on a host
      operationId: v3.3_hosts_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            key_asset:
              description: Flag to set host as a key asset.
              enum:
              - 'true'
              - 'false'
              type: string
              example: true
            note:
              description: Host note to overwrite.
              type: string
              example: Example note
            note_id:
              description: Host note id to overwrite. If not declared oldest note
                is overwritten.
              type: integer
              example: 1
              minimum: 1
          type: object
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
      tags:
      - v3.3/hosts
  /api/v3.3/lockdown/:
    get:
      summary: Get Lockdown List
      description: |
        This is a new endpoint for retrieving a list of entities (accounts, hosts) that are currently in "lockdown"
        mode. API responses may vary depending on product subscriptions (Network, AWS, M365).
      operationId: v3.3_lockdown_list
      parameters:
        - $ref: '#/components/parameters/LockdownListParamsV3_3/entity_type'
        - $ref: '#/components/parameters/LockdownListParamsV3_3/type'
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400RepeatedType'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            items:
              $ref: '#/definitions/LockdownSerializerV3_3'
            type: array
      tags:
      - v3.3/lockdown
    parameters: []
  /api/v3.3/tagging/{table}/:
    delete:
      summary: Bulk Delete Tag
      description: |
        The tagging API can be used to manage tags for accounts, detections, and hosts.

        An API client can use this endpoint to delete a tag for a list of entities.
      operationId: v3.3_tagging_delete
      requestBody:
        $ref: '#/components/requestBodies/BulkTaggingBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
            - $ref: '#/definitions/Error400TaggingInvalidType'
            - $ref: '#/definitions/Error400InvalidParams'
            - $ref: '#/definitions/Error400PatchTagsMissingTags'
            - $ref: '#/definitions/Error400BulkInvalidTag'
        '404':
          description: Not found error.
          schema:
              $ref: '#/definitions/Error404BulkPatchTags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3.3/tagging
    parameters:
      - $ref: "#/components/parameters/TaggingParamsV3_3/table"
      - $ref: "#/components/parameters/TaggingParamsV3_3/type"
      - $ref: "#/components/parameters/TaggingParamsV3_3/entity_type"
    post:
      summary: Bulk Create Tag
      description: |
        The tagging API can be used to manage tags for accounts, detections, and hosts.

        An API client can use this endpoint to create a tag for a list of entities.
      operationId: v3.3_tagging_create
      requestBody:
        $ref: '#/components/requestBodies/BulkTaggingBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400BulkInvalidTag'
              - $ref: '#/definitions/Error400JsonParse'
              - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
              - $ref: '#/definitions/Error400TaggingInvalidType'
              - $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: Not found error.
          schema:
              $ref: '#/definitions/Error404BulkPatchTags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3.3/tagging
  /api/v3.3/tagging/{table}/{entity_id}/:
    get:
      summary: Get Entity Tag List
      description: |
        The tagging API can be used to manage tags for accounts, detections, and hosts.

        An API client can use this endpoint to list tags for a single entity.
      operationId: v3.3_tagging_read
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Tags'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
            - $ref: '#/definitions/Error400TaggingInvalidType'
            - $ref: '#/definitions/Error400InvalidParams'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TaggingSerializerV3'
      tags:
      - v3.3/tagging
    parameters:
      - $ref: "#/components/parameters/TaggingParamsV3_3/table"
      - $ref: "#/components/parameters/TaggingParamsV3_3/type"
      - $ref: "#/components/parameters/TaggingParamsV3_3/entity_type"
      - $ref: "#/components/parameters/TaggingParamsV3/entity_id"
    patch:
      summary: Edit Entity Tag
      description: |
        The tagging API can be used to manage tags for accounts, detections, and hosts.

        An API client can use this endpoint to replace all tags for an entity with a list of tags.
      operationId: v3.3_tagging_partial_update
      requestBody:
        $ref: '#/components/requestBodies/TaggingBodyV3'
      responses:
        '400':
          description: Invalid input error.
          schema:
            oneOf:
              - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
              - $ref: '#/definitions/Error400TaggingInvalidType'
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400PatchTagsInvalidTagType'
              - $ref: '#/definitions/Error400PatchTagsInvalidTag'
              - $ref: '#/definitions/Error400JsonParse'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Tags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TaggingSerializerV3'
      tags:
      - v3.3/tagging
  /api/v3.3/users/:
    get:
      summary: Get User List
      description: |
        User objects contain information about users that have access to the Vectra system. 
        Assignments can be created for users via the Assignments endpoint.
      operationId: v3.3_users_list
      parameters:
        - $ref: '#/components/parameters/UsersListParamsV3_3/page'
        - $ref: '#/components/parameters/UsersListParamsV3_3/page_size'
        - $ref: '#/components/parameters/UsersListParamsV3_3/account_type'
        - $ref: '#/components/parameters/UsersListParamsV3_3/authentication_profile'
        - $ref: '#/components/parameters/UsersListParamsV3_3/last_login_gte'
        - $ref: '#/components/parameters/UsersListParamsV3_3/role'
        - $ref: '#/components/parameters/UsersListParamsV3_3/username'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/UserSerializerV3_3'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.3/users
    parameters: []
  /api/v3.3/vectra-match/alert-stats/:
    get:
      summary: Get Match Alert Stats
      description: |
        Use of the Alert Stats endpoint for Vectra Match does not require a valid license.

        The Alert Stats GET endpoint allows for a single optional query parameter, device_serial.
        If device_serial is not provided, information for all enabled devices will be returned.
      operationId: v3.3_vectra-match_alert-stats_list
      parameters:
        - $ref: '#/components/parameters/VectraMatchParamsV3_3/device_serial'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchAlertStatsSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/match
    parameters: []
  /api/v3.3/vectra-match/assignment/:
    get:
      summary: Get Match Assignment List
      description: |
        Vectra Match Assignment API supports GET, POST, and DELETE.
        Adding a new assignment via POST requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
      operationId: v3.3_vectra-match_assignment_list
      parameters: []
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchAssignmentSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/match
    parameters: []
    post:
      summary: Create Match Assignment
      description: |
        Vectra Match Assignment API supports GET, POST, and DELETE.
        Adding a new assignment via POST requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
      operationId: v3.3_vectra-match_assignment_create
      requestBody:
        $ref: '#/components/requestBodies/MatchAssignmentBodyV3_3'
      parameters:
      - in: body
        name: data
        required: true
      responses:
        ' 201':
          description: ''
          schema:
            $ref: '#/definitions/Response201MatchAssignment'
        ' 200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        ' 400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400MatchEnablement'
            - $ref: '#/definitions/Error400JsonParse'
        ' 401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        ' 403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        ' 404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        ' 413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        ' 415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        ' 429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        ' 500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        ' 503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        ' 504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'

      tags:
      - v3.3/match
    delete:
      summary: Delete Match Assignment
      description: |
        Vectra Match Assignment API supports GET, POST, and DELETE.
        Adding a new assignment via POST requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
      operationId: v3.3_vectra-match_assignment_delete
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            device_serial:
              description: Device serial associated with the rule set
              type: string
              example: L839261748511729ceace80jh2g46f12ff
            uuid:
              description: UUID associated with the rule set.
              type: string
              example: "8cc9a23f-76e4-3035-8h5f-d4728d8g3h76"
          required:
          - uuid
          - device_serial
          type: object
      responses:
        ' 204':
          description: ''
          schema:
            properties:
              details:
                description: Details will be 'success' if successful, otherwise, will
                  contain information about the failure. 
                type: string
                example: success
            type: object
        ' 200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        ' 400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400MatchEnablement'
            - $ref: '#/definitions/Error400JsonParse'
        ' 401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        ' 403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        ' 404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        ' 413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        ' 415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        ' 429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        ' 500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        ' 503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        ' 504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            properties:
              details:
                description: Details will be 'success' if successful, otherwise, will
                  contain information about the failure. 
                type: string
                example: success
            type: object
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/match
  /api/v3.3/vectra-match/available-devices/:
    get:
      summary: Get Match Available Devices
      description: |
        Use of the Available Devices endpoint for Vectra Match does not require a valid license.

        The Available Devices endpoint will return information about all currently paired sensors and,
        in the case of a mixed mode headend, information about the headend itself.
      operationId: v3.3_vectra-match_available-devices_list
      parameters: []
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchAvailableDevicesSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/match
    parameters: []
  /api/v3.3/vectra-match/enablement/:
    get:
      summary: Get Match Enablement
      description: |
        Changing the enablement state on a given device using the POST endpoint requires a license for Vectra Match,
        and an audit log will be emitted (NOTE: a valid Vectra Match license is not required to disable
        Match on a previously enabled device if your license has expired).
      operationId: v3.3_vectra-match_enablement_list
      parameters:
      - description: Filter on the paired device serial number.
        in: query
        name: device_serial
        required: true
        type: string
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchEnablement'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchEnablementSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/match
    parameters: []
    post:
      summary: Create Match Enablement
      description: |
        Changing the enablement state on a given device using the POST endpoint requires a license for Vectra Match,
        and an audit log will be emitted (NOTE: a valid Vectra Match license is not required to disable
        Match on a previously enabled device if your license has expired).
      operationId: v3.3_vectra-match_enablement_create
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            desired_state:
              description: Flag to enable/disable Vectra Match.
              type: boolean
              example: true
            device_serial:
              description: Serial number of the associated device.
              type: string
              example: L839261748511729ceace80jh2g46f12ff
          required:
          - device_serial
          - desired_state
          type: object
      responses:
        ' 201':
          description: ''
          schema:
            $ref: '#/definitions/MatchEnablementSerializerV3_3'
        ' 200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        ' 400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400JsonParse'
            - $ref: '#/definitions/Error400MatchEnablement'
        ' 401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        ' 403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        ' 404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        ' 413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        ' 415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        ' 429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        ' 500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        ' 503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        ' 504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
      tags:
      - v3.3/match
  /api/v3.3/vectra-match/rules/:
    delete:
      summary: Delete Match Rule
      description: |
        Vectra Match Rules API supports GET, POST, and DELETE.
        Uploading a rules file requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
        Once a rules file has been uploaded,
        the API will return a rules file UUID.
        This UUID will be used for managing the ruleset from that point forward
        when interacting with the API.
      operationId: v3.3_vectra-match_rules_delete
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            uuid:
              description: UUID of the associated rules file.
              required: true
              type: string
              example: "8cc9a23f-76e4-3035-8h5f-d4728d8g3h76"
          type: object
      responses:
        ' 204':
          description: ''
        ' 200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        ' 400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchEnablement'
        ' 401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        ' 403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        ' 404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        ' 413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        ' 429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        ' 500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        ' 503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        ' 504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
      tags:
      - v3.3/match
    get:
      summary: Get Match Rule
      description: |
        Vectra Match rules API supports GET, POST, and DELETE.
        Uploading a rules file requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
        Once a rules file has been uploaded,the API will return a rules file uuid.
        This uuid will be used for managing the ruleset from that point forward,
        when interacting with the API.
      operationId: v3.3_vectra-match_rules_list
      parameters:
      - description: Filter on UUID of the desired rules file.
        in: query
        name: uuid
        required: true
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchRulesSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/match
    parameters: []
    post:
      summary: Create Match Rule
      consumes:
      - multipart/form-data
      description: |
        Vectra Match rules API supports GET, POST, and DELETE.
        Uploading a rules file requires a valid license for Vectra Match.
        Audit logs will be emitted for using the POST and DELETE endpoints.
        Once a rules file has been uploaded,the API will return a rules file uuid.
        This uuid will be used for managing the ruleset from that point forward,
        when interacting with the API.
      operationId: v3.3_vectra-match_rules_create
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            file:
              description: File to upload.
              type: file
            notes:
              description: Notes to store about the file.
              type: string
              example: Example note
            rotate:
              description: Flag for file replacement. If set to true,  if the Vectra
                system is above the 25 file limit, the oldest unassigned file will
                be deleted automatically, and replaced by the file currently being
                uploaded, if possible
              type: boolean
              example: true
          required:
          - file
          type: object
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/MatchRulesSerializerV3_3'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/deprecated
  /api/v3.3/vectra-match/stats/:
    get:
      summary: Get Match Stats
      description: |
        Use of the Stats endpoint for Vectra Match does not require a valid license.

        The Stats GET endpoint allows for a single optional query parameter, device_serial. If device_serial is
        not provided, information for all enabled and previously-enabled devices will be returned.

      operationId: v3.3_vectra-match_stats_list
      parameters:
      - description: Filter on the paired device serial number.
        in: query
        name: device_serial
        required: false
        type: string
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchEnablement'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchStatsSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/match
    parameters: []
  /api/v3.3/vectra-match/status/:
    get:
      summary: Get Match Status
      description: |
        Use of the Status endpoint for Vectra Match does not require a valid license.

        The status GET endpoint allows for a single optional query parameter, device_serial.
        If device_serial is not provided, information for all enabled and previously-enabled
        devices will be returned.
      operationId: v3.3_vectra-match_status_list
      parameters:
      - description: Filter on the paired device serial number.
        in: query
        name: device_serial
        required: false
        type: string
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchEnablement'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchEnablement'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - $ref: '#/definitions/MatchStatusSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/match
    parameters: []
  /api/v3.3/{tvui_types}/notes/:
    parameters:
      - $ref: '#/components/parameters/NotesParamsV3_3/tvui_types'
      - $ref: '#/components/parameters/NotesParamsV3_3/type'
      - $ref: '#/components/parameters/NotesParamsV3_3/entity_type'
    post:
      summary: Bulk Create Note
      description: |
        The note API can be used to manage notes for accounts, detections, and hosts.

        An API client can use this endpoint to create a notes for a list of entities. There is no max limit on the number of 
        entity ids that can be included in the request body. An audit event will be created when successfully creating notes
        via this endpoint; the audit will only capture the first 50 ids provided in the request body. 
      operationId: v3.3_bulk_notes_create
      requestBody:
        $ref: '#/components/requestBodies/BulkCreateNotesBodyV3_3'
      responses:
        '400':
          description: 'Entity type required error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
            - $ref: '#/definitions/Error400JsonParse'
            - $ref: '#/definitions/Error400InvalidParams'
            - $ref: '#/definitions/Error400NoteInvalidType'
            - $ref: '#/definitions/Error400BulkNotesMissingBodyParam'
            - $ref: '#/definitions/Error400BulkNotesExtraBodyParam'
            - $ref: '#/definitions/Error400BulkNotesInvalidBodyValue'
            - $ref: '#/definitions/Error400BulkNotesEmptyValue'
            - $ref: '#/definitions/Error400InvalidJson'
        '404':
          description: Not found error.
          schema:
            oneOf:
            - $ref: '#/definitions/Error404BulkNotesNotFound'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '415':
          description: Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3.3/notes
  /api/v3.3/{tvui_types}/{type_id}/notes/:
    get:
      summary: Get Entity Note List
      description: |
        An API client can list all of the Note objects associated with a single entity using this endpoint.
      operationId: v3.3_notes_list
      parameters:
      - description: The type of note associated entity. Type or entity_type is required
          if tvui_types is set to entities.
        enum:
        - account
        - host
        in: query
        name: entity_type
        type: string
      - description: The type of note associated entity. Type or entity_type is required
          if tvui_types is set to entities.
        enum:
        - account
        - host
        in: query
        name: type
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '400':
          description: 'Entity type required error.'
          schema:
            $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            items:
              $ref: '#/definitions/NoteSerializerV2_2'
            type: array
      tags:
      - v3.3/notes
    parameters:
      - $ref: '#/components/parameters/NotesParamsV3_3/type'
      - $ref: '#/components/parameters/NotesParamsV3_3/entity_type'
      - $ref: '#/components/parameters/NotesParamsV3_3/tvui_types'
      - $ref: '#/components/parameters/NotesParamsV3/type_id'
    post:
      summary: Create Entity Note
      description: |
        An API client can use this endpoint to create a note for an entity.
      operationId: v3.3_notes_create
      requestBody:
        $ref: '#/components/requestBodies/NotesBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostNotes'
            - $ref: '#/definitions/Error400JsonParse'
            - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.3/notes
  /api/v3.3/{tvui_types}/{type_id}/notes/{note_id}/:
    delete:
      summary: Delete Entity Note
      description: |
        An API client can use this endpoint to delete a note for an entity.
      operationId: v3.3_notes_delete
      responses:
        '400':
          description: 'Entity type required error.'
          schema:
            $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.3/notes
    get:
      summary: Get Entity Single Note
      description: |
        An API client can use this endpoint to view a note for an entity.
      operationId: v3.3_notes_read
      responses:
        '400':
          description: 'Entity type required error.'
          schema:
            $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error404Generic'
              - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.3/notes
    parameters:
      - $ref: '#/components/parameters/NotesParamsV3_3/type'
      - $ref: '#/components/parameters/NotesParamsV3_3/entity_type'
      - $ref: '#/components/parameters/NotesParamsV3_3/tvui_types'
      - $ref: '#/components/parameters/NotesParamsV3/type_id'
      - $ref: '#/components/parameters/NotesParamsV3/note_id'
    patch:
      summary: Edit Entity Note
      description: |
        An API client can use this endpoint to modify a note for an entity.
      operationId: v3.3_notes_partial_update
      requestBody:
        $ref: '#/components/requestBodies/NotesBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '400':
          description: 'Invalid input error for note.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
            - $ref: '#/definitions/Error400PostNotes'
            - $ref: '#/definitions/Error400JsonParse'
        '422':
          description: 'Invalid input error. Missing note param.'
          schema:
            $ref: '#/definitions/Error422PatchNoteMissingNote'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.3/notes
  /api/v3.3/threatFeeds/:
    get:
      summary: Get Threatfeed List
      operationId: v3.3_threatFeeds_list
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already configured in
        the system.

        This endpoint is used to obtain the list of threat feeds (GET).

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters:
      - name: page
        in: query
        description: A page number within the paginated result set.
        required: false
        type: integer
      - name: page_size
        in: query
        description: Number of results to return per page.
        required: false
        type: integer
      - description: Which field to use when ordering the results.
        in: query
        name: ordering
        required: false
        type: string
        enum: 
        - 'name'
        - 'lastUpdatedBy'
        - 'lastUpdated'
        - 'category'
        - 'certainty'
        - 'expiration'
      - name: name
        type: string
        description: Filter by feed name.
        in: query
      - name: category
        type: string
        in: query
        description: Filter by feed category.
        enum:
        - cnc
        - lateral
        - exfil
      - name: certainty
        type: string
        in: query
        description: Filter by feed certainty.
        enum:
        - High
        - Medium
        - Low
      - name: expiration
        type: string
        in: query
        format: date-time
        description: Filter by feed expiration date.
      - name: last_updated
        type: string
        in: query
        format: date-time
        description: Filter by feed last updated date.
      - name: last_updated_by
        type: string
        in: query
        description: Filter feeds by the user making the last update.
      - name: expiration_gte
        type: string
        in: query
        format: date-time
        description: Filter by feed expiration greater than the given date.
      - name: expiration_lte
        type: string
        in: query
        format: date-time
        description: Filter by feed expiration less than the given date.
      - name: last_updated_gte
        type: string
        in: query
        format: date-time
        description: Filter by feed latest update greater than the given date.
      - name: last_updated_lte
        type: string
        in: query
        format: date-time
        description: Filter by feed latest update less than the given date.
      responses:
        '422':
          description: The ordering param requested is invalid.
          schema:
            $ref: '#/definitions/Error422GetThreatfeeds'
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - type: object
              title: 'Success'
              properties:
                count:
                  type: integer
                  example: 1
                next:
                  format: uri
                  type: string
                  x-nullable: true
                  example: https://VECTRA_PORTAL_URL/api/v3.3/threatFeeds?page=2&page_size=1
                previous:
                  format: uri
                  type: string
                  x-nullable: true
                  example: null
                results:
                  items:
                    $ref: '#/definitions/ThreatFeedSerializerV3_3'
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/threatFeeds
    post:
      summary: Create Threatfeed
      operationId: v3.3_threatFeeds_create
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already configured in
        the system.

        This endpoint is used to create a new threat Feed (POST).

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters:
      - name: data
        in: body
        required: true
        schema:
          type: object
          properties:
            threatFeed:
              type: object
              properties:
                name:
                  type: string
                  example: Example name
                defaults:
                  type: object
                  description: Dictionary describing threat feed default
                    values. 
                  properties:
                    indicatorType:
                      type: string
                      enum:
                      - Anonymization
                      - C2
                      - Exfiltration
                      - Malware Artifacts
                      - Watchlist
                      example: Anonymization
                    certainty:
                      type: string
                      enum:
                      - Low
                      - Medium
                      - High
                      example: High
                    duration:
                      type: integer
                      example: 7
                    category:
                      type: string
                      enum:
                      - cnc
                      - exfil
                      - lateral
                      example: cnc
                  required:
                    - indicatorType
                    - certainty
                    - category
          required:
            - treatFeed
      responses:
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422PostThreatfeeds'
        '409':
          description: 'Conflict error.'
          schema:
            $ref: '#/definitions/Error409PostThreatfeeds'
        '400':
          description: 'JSON syntax error in request body.'
          schema:
            $ref: '#/definitions/Error400PostThreatfeeds'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        '201':
          description: ''
          schema:
            type: object
            properties:
              threatFeed:
                type: object
                properties:
                  name:
                    type: string
                    description: The name of the threat feed. 
                    example: Example feed
                  id:
                    type: string
                    description: The ID of the threat feed. 
                    example: 5ra34a3t78c6jk0b65494a84jrkc09c3
                  defaults:
                    type: object
                    description: Dictionary describing threat feed default
                      values. 
                    properties:
                      indicatorType:
                        type: string
                        description: Indicator Type of the threat feed. 
                        example: C2
                      certainty:
                        type: string
                        description: Certainty of the threat feed. 
                        example: High
                      duration:
                        type: integer
                        descrption: Duration of the threat feed until expiration. 
                        example: 90
                      category:
                        type: string
                        description: Threat Feed Category (lateral, cnc, exfil). 
                        example: cnc
      tags:
      - v3.3/threatFeeds
    parameters: []
  /api/v3.3/threatFeeds/{feed_id}/:
    get:
      summary: Get Single Threatfeed
      operationId: v3.3_threatFeeds_read
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to obtain details of any threat feed (GET).

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500ThreatfeedFile'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - type: object
              title: 'Success'
              properties:
                id:
                  title: Id
                  type: string
                  description: The ID of the threat feed. 
                  example: 5ra34a3t78c6jk0b65494a84jrkc09c3
                _rev:
                  title: rev
                  type: string
                  description: The revision ID of the threat feed. 
                  example: 1-6dg0f0ab6a2b3hdj29814fh9307tt575f
                name:
                  title: Name
                  type: string
                  description: The name of the threat feed. 
                  example: "Test Stix"
                lastUpdatedBy:
                  title: Last updated by
                  type: string
                  description: The user who updated the threat feed. 
                  example: "email@domain.com"
                version:
                  title: Version
                  type: string
                  description: The version of the threat feed. 
                  example: 7.8-313
                uploadDate:
                  title: Upload date
                  type: string
                  description: The creation date of the threat feed. 
                  format: date-time
                lastUpdated:
                  title: Last updated
                  type: string
                  description: The last update date of the threat feed. 
                  format: date-time
                uploadResults:
                  title: Upload results
                  type: object
                  description: Dictionary describing the file uploaded 
                  example:
                    indicatorType: 'Malware Artifacts'
                    observableCount: 2
                    certainty: 'High'
                    expiration: '2025-05-04T14:52:22.024435+00:00'
                    category: 'cnc'
                type:
                  title: Type
                  type: string
                  description: Threat Feed 
                  example: STIX
                defaults:
                  type: object
                  description: Dictionary describing threat feed default
                    values. 
                  properties:
                    indicatorType:
                      type: string
                      example: C2
                    certainty:
                      type: string
                      example: High
                    duration:
                      type: integer
                      example: 90
                    category:
                      type: string
                      example: cnc
                data:
                  type: object
                  description: The data from the STIX file. 
                  example: 
                    id: exampledata:Package-5ttle90e
                    version: 1.2
                    indicators: []
                    reports: []
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/threatFeeds
    post:
      summary: Add Threatfeed File
      operationId: v3.3_threatFeed_create
      consumes:
      - multipart/form-data
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to add a file to a threat feed (POST).

        **File Upload Specifications**

        There is a hard limit for file upload sizes of 5 MB at this time.
        If you receive a "413 Payload Too Large" error while uploading a file via POST,
        the file you are attempting to upload is too large. There is no limit on the
        amount of threatFeeds files you can upload, so we recommend splitting apart
        your STIX file into smaller parts and uploading each as its own threat feed so
        that each file is below the 5MB limit.
      parameters:
      - in: body
        name: data
        required: true
        schema:
          type: object
          properties:
            file:
              description: File to upload.
              type: file
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404PostThreatfeedId'
        '415':
          description: 'Invalid media type provided in the request body.'
          schema:
            $ref: '#/definitions/Error415InvalidMediaType'
        '400':
          description: 'JSON syntax error in request body.'
          schema:
            $ref: '#/definitions/Error400PostThreatfeeds'
        '409':
          description: 'Conflict error.'
          schema:
            $ref: '#/definitions/Error409PostThreatfeeds'
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422PostThreatfeedId'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500ThreatfeedFile'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        '201':
          description: ''
          schema:
            type: object
            properties:
              threatFeed:
                type: object
                properties:
                  uploadResults:
                    title: Upload results
                    type: object
                    description: Dictionary describing the file uploaded 
                    properties:
                      indicatorType:
                        type: string
                        example: C2
                      certainty:
                        type: string
                        example: High
                      duration:
                        type: integer
                        example: 90
                      category:
                        type: string
                        example: cnc
      tags:
      - v3.3/threatFeeds
    patch:
      summary: Edit Threatfeed
      operationId: v3.3_threatFeeds_partial_update
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to update a threat feed (PATCH).
      parameters:
      - name: data
        in: body
        required: true
        schema:
          type: object
          properties:
            threatFeed:
              type: object
              properties:
                name:
                  type: string
                  example: Example name
                defaults:
                  description: Dictionary describing threat feed default
                    values. 
                  type: object
                  properties:
                    indicatorType:
                      type: string
                      enum:
                      - Anonymization
                      - C2
                      - Exfiltration
                      - Malware Artifacts
                      - Watchlist
                      example: Anonymization
                    certainty:
                      type: string
                      enum:
                      - Low
                      - Medium
                      - High
                      example: High
                    duration:
                      type: integer
                      example: 6
                    category:
                      type: string
                      enum:
                      - cnc
                      - exfil
                      - lateral
                      example: cnc
                  required:
                    - indicatorType
                    - certainty
                    - category
                upload:
                  type: object
                  properties:
                    replace_filename:
                      type: string
                      example: old_filename
                    filename:
                      type: string
                      example: new_filename
      responses:
        '409':
          description: 'Conflict error.'
          schema:
            $ref: '#/definitions/Error409PostThreatfeeds'
        '422':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error422PostThreatfeedId'
            - $ref: '#/definitions/Error422PatchThreatfeedId'
        '400':
          description: 'JSON syntax error in request body.'
          schema:
            $ref: '#/definitions/Error400PostThreatfeeds'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404PostThreatfeedId'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500ThreatfeedFile'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            oneOf:
            - type: object
              title: Success
              properties:
                threatFeed:
                  type: object
                  properties:
                    name:
                      type: string
                      example: Test Feed
                    id:
                      type: string
                      example: 1-6dg0f0ab6a2b3hdj29814fh9307tt575f
                    default:
                      title: default
                      type: object
                      description: Dictionary describing the file uploaded. 
                      properties:
                        indicatorType:
                          type: string
                          example: C2
                        certainty:
                          type: string
                          example: High
                        duration:
                          type: integer
                          example: 90
                        category:
                          type: string
                          example: cnc
            - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/threatFeeds
    delete:
      summary: Delete Threatfeed
      operationId: v3.3_threatFeeds_delete
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to delete a threat feed (DELETE).
      parameters: []
      responses:
        '409':
          description: 'Conflict error.'
          schema:
            $ref: '#/definitions/Error409PostThreatfeeds'
        '404':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error404PostThreatfeedId'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500ThreatfeedFile'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        '204':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                description: Success status of the deletion.
                example: success
      tags:
      - v3.3/threatFeeds
    parameters:
    - name: feed_id
      in: path
      required: true
      type: string
  /api/v3.3/threatFeeds/{feed_id}/file/:
    get:
      summary: Get Threatfeed File
      operationId: v3.3_threatFeeds_file_list
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to download a threat feed file (GET).

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters: []
      produces:
        - application/xml
      responses:
        '404':
          description: 'Not found error.'
          schema:
            - $ref: '#/definitions/Error404Threatfeed'
            - $ref: '#/definitions/Error404ThreatfeedFile'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'The file is returned in XML format for the successful response.'
          schema:
            oneOf:
              - type: string
                format: binary
                title: 'Success'
              - $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/threatFeeds
    delete:
      summary: Delete Threatfeed File
      operationId: v3.3_threatFeeds_file_delete
      description: |
        The threat feeds API can be used to automate the upload of
        STIX files for threat intelligence matching. The API endpoint
        can also be used to retrieve the current list of threat feed objects already
        configured in the system.

        This endpoint is used to delete a threat feed file (DELETE).

        API responses may vary depending on product subscriptions (Network, AWS, M365).
      parameters: []
      responses:
        '409':
          description: 'Resource conflict error.'
          schema:
            $ref: '#/definitions/Error409ThreatfeedFileConflict'
        '404':
          description: 'Not found error.'
          schema:
            - $ref: '#/definitions/Error404Threatfeed'
            - $ref: '#/definitions/Error404ThreatfeedFile'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500ThreatfeedFile'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: 'Network to SaaS not available'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
        '204':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                description: Success status of the deletion.
                example: success
      tags:
      - v3.3/threatFeeds
    parameters:
    - name: feed_id
      in: path
      required: true
      type: string
  /api/v3.3/unique_hosts_observed/:
    get:
      summary: Get Unique Hosts Observed
      operationId: v3.3_unique_hosts_observed_list
      description: |
        This endpoint has been deprecated. API users will be prompted to use the v3.4 version of this endpoint.

        The unique hosts observed API can be used to view the count
        of all distinct hosts seen during a calendar month, for each
        month dating back one year.
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '301':
          schema:
            type: object
            properties:
              message: 
                type: string
                enum:
                  - "Moved permanently to /v3.4/unique_hosts_observed"
                example: "Moved permanently to /v3.4/unique_hosts_observed"
        '200':
          description: 'This response is returned when the Vectra UI instance making the request does not have a network brain connection configured.'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/deprecated
    parameters: []
  /api/v3.3/unique_hosts_observed/audit/:
    get:
      summary: Get Unique Hosts Observed Audit
      operationId: v3.3_unique_hosts_observed_audit_list
      description: |
        This endpoint has been deprecated. API users will be prompted to use the v3.4 version of this endpoint.

        The unique hosts observed API can be used to view of all the
        distinct hosts seen during a calendar month, for each month
        dating back one year.
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '301':
          schema:
            type: object
            properties:
              message: 
                type: string
                enum:
                  - "Moved permanently to /v3.4/unique_hosts_observed/audit"
                example: "Moved permanently to /v3.4/unique_hosts_observed/audit"
        '200':
          description: 'This response is returned when the Vectra UI instance making the request does not have a network brain connection configured.'
          schema:
            $ref: '#/definitions/Response200NtCCheck'
      tags:
      - v3.3/deprecated
    parameters: []
  /api/v3.3/vectra-match/rules/upload/:
    get:
      summary: Get Match Rule Upload List
      description: |
        Vectra Match Rules upload API supports GET, and POST.
        Uploading a rules requires a valid license for Vectra Match.
        The list endpoint returns rules files and their status uploading
        and syncing to S3.        
      operationId: v3.3_vectra-match_rules_upload_list
      parameters: []
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchRuleUploadGet'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchRuleUploadGet'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              files:
                items:
                  $ref: '#/definitions/VectraMatchRulesUploadV3_3'
                type: array
            type: object
      tags:
      - v3.3/match
    post:
      summary: Create Match Rule Upload
      description: |
        Vectra Match Rules Upload API supports GET, and POST.
        Uploading rules requires a valid license for Vectra Match.
        The POST endpoint accepts a file name and notes.
        It will create a rule, upload the file to S3, and enable the
        rule on a sensor.        
      operationId: v3.3_vectra-match_rules_upload_post
      parameters:
      - name: data
        in: body
        required: true
        schema:
          type: object
          properties:
            file_name:
              type: string
              description: The file name for upload.  
              example: example_filename
            notes:
              type: string
              description: Notes on the file upload.  
              example: Example note
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchRuleUploadPost'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/VectraMatchRuleUploadPostV3_3'
      tags:
      - v3.3/match
  /api/v3.3/vectra-match/rules/upload/{uuid}/:
    get:
      summary: Get Match Single Rule Upload
      description: |
        Get the details of the upload.

        Use this endpoint to check that the uploaded file has successfully synced to the appliance.

        * Uploading a rules file requires a valid license for Vectra Match.
      operationId: v3.3_vectra-match_rules_upload_read
      parameters:
      - in: path
        name: uuid
        required: true
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            - $ref: '#/definitions/Error404URLNotFound'
            - $ref: '#/definitions/Error404MatchRuleUploadGet'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/VectraMatchRuleUploadV3_3'
      tags:
      - v3.3/match
    patch:
      summary: Edit Match Rule Upload
      description: |
        Mark the Match upload status as completed.

        After you have uploaded your file to the URL you received when you 
        created the upload, use this endpoint to mark the upload as completed. 
        This will start the sync of your file to the appliance.

        * Uploading a rules file requires a valid license for Vectra Match.
        * Audit logs will be emitted for using the POST and PATCH endpoints. 
      operationId: v3.3_vectra-match_rules_upload_patch
      parameters:
      - name: data
        in: body
        required: true
        schema:
          type: object
          properties:
            upload_status:
              description: Current upload status
              required: true
              example: completed
              type: string
              enum:
              - completed
              - aborted
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404URLNotFound'
            - $ref: '#/definitions/Error404MatchRuleUploadPatch'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400MatchRuleUploadPatch'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              upload_status:
                type: string
                description: Status of the file upload. 
                enum:
                - completed
                - aborted
            type: object
      tags:
      - v3.3/match
    parameters:
    - in: path
      name: uuid
      required: true
      type: string
  /api/v3.3/vectra-match/download-vectra-ruleset/:
    get:
      summary: Get Match Download Ruleset
      description: |
        GET a download url for the curated ruleset or the file itself for appliance-only deployments
      operationId: v3.3_vectra-match_download_vectra_ruleset
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchDownloadRulset'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error403'
            - $ref: '#/definitions/Error403MatchDownloadRulset'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500MatchDownloadRulset'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/VectraMatchCuratedRulesetDownloadV3_3'
      tags:
      - v3.3/match
  /api/v3.4/vectra-match/download-vectra-ruleset/:
    get:
      summary: Get Match Download Ruleset
      description: |
        GET a download url for the curated ruleset or the file itself for appliance-only deployments.
      operationId: v3.4_vectra-match_download_vectra_ruleset
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404MatchDownloadRulset'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error403'
            - $ref: '#/definitions/Error403MatchDownloadRulset'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error500'
            - $ref: '#/definitions/Error500MatchDownloadRulset'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/VectraMatchCuratedRulesetDownloadV3_3'
      tags:
      - v3.4/match
  /api/v3.2/accounts/:
    get:
      summary: Get Account List
      description: |
        Account objects contain information related to accounts observed in the environment.
      operationId: v3.2_accounts_list
      parameters:
        - $ref: '#/components/parameters/AccountsListParamsV3/ordering'
        - $ref: '#/components/parameters/AccountsListParamsV3/page'
        - $ref: '#/components/parameters/AccountsListParamsV3/page_size'
        - $ref: '#/components/parameters/AccountsListParamsV3/all'
        - $ref: '#/components/parameters/AccountsListParamsV3/c_score'
        - $ref: '#/components/parameters/AccountsListParamsV3/c_score_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/certainty'
        - $ref: '#/components/parameters/AccountsListParamsV3/certainty_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/exclude_fields'
        - $ref: '#/components/parameters/AccountsListParamsV3/fields'
        - $ref: '#/components/parameters/AccountsListParamsV3/first_seen'
        - $ref: '#/components/parameters/AccountsListParamsV3/id'
        - $ref: '#/components/parameters/AccountsListParamsV3/include_detection_summaries'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_detection_timestamp_lte'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_seen'
        - $ref: '#/components/parameters/AccountsListParamsV3/max_id'
        - $ref: '#/components/parameters/AccountsListParamsV3/min_id'
        - $ref: '#/components/parameters/AccountsListParamsV3/name'
        - $ref: '#/components/parameters/AccountsListParamsV3/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_category'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_level'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_level_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/state'
        - $ref: '#/components/parameters/AccountsListParamsV3/t_score'
        - $ref: '#/components/parameters/AccountsListParamsV3/t_score_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/tags'
        - $ref: '#/components/parameters/AccountsListParamsV3/threat'
        - $ref: '#/components/parameters/AccountsListParamsV3/threat_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/uid'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/AccountSerializerV3_2'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.2/accounts
    parameters: []
  /api/v3.2/accounts/{id}/:
    get:
      summary: Get Single Account
      description: |
        Account objects contain information related to accounts observed in the environment.
      operationId: v3.2_accounts_read
      parameters:
        - $ref: '#/components/parameters/AccountsReadParamsV3/exclude_fields'
        - $ref: '#/components/parameters/AccountsReadParamsV3/fields'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_access_history'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_detection_summaries'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_external'
        - $ref: '#/components/parameters/AccountsReadParamsV3/src_linked_account'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/SingleAccountSerializerV3_2'
      tags:
      - v3.2/accounts
    parameters:
    - in: path
      name: id
      required: true
      type: integer
  /api/v3.2/assignment_outcomes/:
    get:
      summary: Get Assignment Outcome List
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        This information includes but is not limited to:
          *	ID
          *	Title
          *	Category
      operationId: v3.2_assignment_outcomes_list
      parameters:
        - description: A page number within the paginated result set.
          in: query
          name: page
          required: false
          type: integer
          example: 1
          minimum: 1
        - description: Number of results to return per page.
          in: query
          name: page_size
          required: false
          type: integer
          minimum: 1
          example: 5
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/AssignmentOutcome'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.2/assignment_outcomes
    parameters: []
    post:
      summary: Create Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can create an outcome using this endpoint.
      operationId: v3.2_assignment_outcomes_create
      requestBody:
        $ref: '#/components/requestBodies/AssignmentOutcomePostBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignmentOutcomes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.2/assignment_outcomes
  /api/v3.2/assignment_outcomes/{id}/:
    delete:
      summary: Delete Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can delete an outcome using this endpoint.
      operationId: v3.2_assignment_outcomes_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400DeleteAssignmentOutcome'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.2/assignment_outcomes
    get:
      summary: Get Single Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        This information includes but is not limited to:
          *	ID
          *	Title
          *	Category
      operationId: v3.2_assignment_outcomes_read
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.2/assignment_outcomes
    parameters:
    - description: A unique integer value identifying this assignment outcome.
      in: path
      name: id
      required: true
      type: integer
      example: 1
      minimum: 1
    put:
      summary: Edit Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can modify an outcome using this endpoint.
      operationId: v3.2_assignment_outcomes_partial_update
      requestBody:
        $ref: '#/components/requestBodies/AssignmentOutcomePatchBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignmentOutcomes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.2/assignment_outcomes
  /api/v3.2/assignments/:
    get:
      summary: Get Assignment List
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        This information includes but is not limited to:
          * Assigned to user
          * Assigned by user
          * Date assigned
          * Date resolved
          * Events
          * Outcome
          * Account ID
          * Triaged detections
      operationId: v3.2_assignments_list
      parameters:
        - $ref: '#/components/parameters/AssignmentsListParamsV3/page'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/page_size'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/accounts'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/assignees'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/created_after'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/hosts'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/resolution'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/resolved'
      responses:
        '400':
          description: Invalid query parameter, parameter value, or authorization error.
          schema:
           oneOf:
            - $ref: '#/definitions/Error400GetAssignments'
            - $ref: '#/definitions/Error400InvalidParams'
            - $ref: '#/definitions/Error400InvalidParamValue'
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/Assignment'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.2/assignments
    post:
      summary: Create Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        The creation of assignments is handled by this endpoint.
      operationId: v3.2_assignments_create
      requestBody:
        $ref: '#/components/requestBodies/AssignmentPostBodyV3'
      responses:
        '400':
          description: "Invalid input error."
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignments'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.2/assignments
  /api/v3.2/assignments/{id}/:
    delete:
      summary: Delete Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        This endpoint handles deleting a single assignment.
      operationId: v3.2_assignments_delete
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.2/assignments
    get:
      summary: Get Single Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        This information includes but is not limited to:
          * Assigned to user
          * Assigned by user
          * Date assigned
          * Date resolved
          * Events
          * Outcome
          * Account ID
          * Triaged detections
      operationId: v3.2_assignments_read
      responses:
        '400':
          description: 'Invalid query parameter.'
          schema:
            $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.2/assignments
    parameters:
      - $ref: "#/components/parameters/AssignmentsReadParamsV3/id"
    put:
      summary: Edit Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.

        An API client can modify the user and/or account associated to an assignment using this endpoint.s
      operationId: v3.2_assignments_update
      requestBody:
        $ref: '#/components/requestBodies/AssignmentPutBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: "Invalid input error."
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignments'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.2/assignments
  /api/v3.2/assignments/{id}/resolve/:
    parameters:
      - $ref: "#/components/parameters/AssignmentsReadParamsV3/id"
    put:
      summary: Resolve Assignment
      description: |
        Once completed, assignments can be resolved. Assignment resolutions provide a way to label and track
        the outcomes of assignments. Outcomes get recorded in the assignment's history.

        Outcome choices may include one of the following built-in assignment outcomes:
          * Benign True Positive
          * Malicious True Positive
          * False Positive

        Alternatively, users can choose to define their own Custom outcomes for reporting purposes.
      operationId: v3.2_assignments_resolve
      requestBody:
        $ref: '#/components/requestBodies/AssignmentsResolveBodyV3'
      responses:
        '409':
          description: 'Conflict error, assignment hsa already been resolved.'
          schema:
            $ref: '#/definitions/Error409ResolveAssignments'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: Invalid input error.
          schema:
            oneOf:
            - $ref: '#/definitions/Error400ResolveAssignmentsDetectionIDs'
            - $ref: '#/definitions/Error400ResolveAssignmentsOutcome'
            - $ref: '#/definitions/Error400ResolveAssignmentsTriageAs'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.2/assignments
  /api/v3.2/rules/:
    get:
      summary: Get Rule List
      tags:
      - v3.2/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint lists the existing Triage Rules in the system.
      operationId: v3.2_rules_list
      parameters:
        - $ref: '#/components/parameters/Common/ordering'
        - $ref: '#/components/parameters/Common/page'
        - $ref: '#/components/parameters/Common/page_size'
        - $ref: '#/components/parameters/RulesParamsV3/contains'
        - $ref: '#/components/parameters/RulesParamsV3/fields'
        - $ref: '#/components/parameters/RulesParamsV3/include_templates'
      responses:
        '404':
            description: The requested page does not exist. Reduce the requested page.
            schema:
              $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/RuleSerializerV3'
                type: array
    post:
      summary: Create Rule
      tags:
      - v3.2/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This path's POST method supports two different creation tasks
        depending on the request body.

        **Task A**

        When specifying a new triage category in the request body
        without a detection list, this endpoint creates new Triage Rules.

        The following format is required for source_conditions
        and additional_conditions in the request body:

        The format for Triage rules is based on AND/OR logic,
        making them more flexible and customizable to your specific situation.
        Both 'source_conditions' and 'additional_conditions' are now
        saved as JSON blobs which represents a tree-like structure.
        Each tree node is represented in the following format:

        ```
        {operator: operand}
        ```

        Where "operator" is any of the following:

        ```
        For non-leaf nodes: 'AND' or 'OR'
        For leaf nodes: 'ANY_OF' or 'NONE_OF'
        ```

        The format for "operand" also depends on the type of node.

        For non-leaf nodes, use a list of children tree nodes of the form:

        ```
        [{operator: operand}, {operator: operand}, ...]
        ```

        For leaf nodes, use a dictionary of the form:

        ```
        {
          'field': <FIELD NAME>,
          'values': [{'value': [<VALUE>]}],
          'group': [{'value': [<GROUP ID>]}]
        }
        ```

        Stipulations on the format of the top-level tree structure
        is that the top-level operator must be an 'OR' node, with
        a single 'AND' node as the only child. The 'AND' node may have an arbitrary number
        of leaf node children. All valid Triage rules will look as follows:

        ```
        {
          'OR': [
            {
              'AND': [
                <LEAF NODE 1>,
                <LEAF NODE 2>,
                ...
                <LEAF NODE N>,
              ]
            }
          ]
        }
        ```

        Note 'source_conditions' and 'additional_conditions' have different fields
        that can be used in their leaf nodes. For 'source_conditions', the following
        fields are valid: ip, host, account, sensor. The fields 'ip' and 'host'
        also support triaging on groups, meaning that an IP or a host leaf node can
        be given an IP Group or Host Group ID, and the Triage rule will apply to
        every IP/host in the specified group. For 'additional_conditions', the following
        fields are valid: remote1_ip, remote1_proto, remote1_port, remote1_dns, remote2_ip,
        remote2_proto, remote2_port, remote2_dns, account, named_pipe, uuid,
        identity, share, extensions, rdp client name, rdp client token, keyboard name.
        The fields 'remote1_ip', 'remote2_ip', 'remote1_dns', 'remote2_dns' support
        triaging on groups. Either 'source_conditions' or 'additional_conditions' may
        be null. Setting source_conditions to null implies that this Triage rule with
        apply to All Hosts.

        **Task B**

        The POST Triage Rules endpoint can be used with a
        request body specifying detection ids and a triage category
        to filter a set of detections under the chosen triage category
      operationId: v3.2_rules_create
      parameters:
      - in: body
        name: data
        required: true
        schema:
          oneOf:
          - title: Task A
            description: The schema for Task A.
            $ref: '#/definitions/RuleRequestBodyV3'
          - type: object
            title: Task B
            description: The schema for Task B.
            properties:
              detectionIdList:
                description: Detections ids to add to triage rule filter.
                items:
                  type: integer
                  example: 1
                type: array
              triage_category:
                type: string
                example: Benign Detection
                description: Custom Triage label used to categorize specified detections.
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400JsonParse'
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error422PostRulesInvalidField'
              - $ref: '#/definitions/Error422PostRulesConditionsField'
              - $ref: '#/definitions/Error422PostRulesDetectionList'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            oneOf:
            - type: object
              title: Task A
              description: The response for Task A.
              properties:
                id:
                  type: integer
                  description: Rule ID. 
                  example: 1
                _meta:
                  type: object
                  properties:
                    level:
                      type: string
                      description: Success status of operation. 
                      example: Success
                    message:
                      type: string
                      description: Message of success status of operation. 
                      example: "Successfully created triage filter"
            - type: object
              title: Task B
              description: The response for Task B.
              properties:
                ids:
                  type: array
                  items:
                    type: integer
                    example: 1
                  description: Rule IDs. 
                _meta:
                  type: object
                  properties:
                    level:
                      type: string
                      description: Success status of operation. 
                      example: Success
                    message:
                      type: string
                      description: Message of success status of operation. 
                      example: "Successfully created triage filter"
    delete:
      summary: Delete Detections Rule
      tags:
      - v3.2/rules
      description: |
        The DELETE Triage Rules endpoint can be used with the following
        request body to remove triage filters for a set of detections.
      operationId: v3.2_detection_rules_delete
      parameters:
      - in: body
        name: data
        required: true
        schema:
          type: object
          properties:
            detectionIdList:
              description: Detections ids to remove triage rule filters.
              items:
                type: integer
                example: 1
              type: array
      responses:
        '422':
          description: Invalid input for detectionIdList.
          schema:
            $ref: '#/definitions/Error422DeleteRulesDetectionList'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
  /api/v3.2/rules/{rule_id}/:
    parameters:
    - in: path
      name: rule_id
      required: true
      type: integer
      description: The rule ID. 
    get:
      summary: Get Single Rule
      tags:
      - v3.2/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint lists a single Triage Rules in the system.
      operationId: v3_2_rule_read
      parameters:
      - description: Which field to use when ordering the results.
        in: query
        name: fields
        required: false
        type: string
        enum:
        - id
        - url
        - description
        - enabled
        - created_timestamp
        - last_timestamp
        - is_whitelist
        - priority
        - active_detections
        - total detections
        - template
        - additional_conditions
        - source_condition
        - detection
        - detection_category
        - triage_category
      responses:
        '400':
          description: Invalid query parameter requested.
          schema:
           $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/RuleSerializerV3'
    put:
      summary: Edit Rule
      tags:
      - v3.2/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint manages updating Triage Rules.

        The following format is required for source_conditions
        and additional_conditions in the request body:

        The format for Triage rules is based on AND/OR logic,
        making them more flexible and customizable to your specific situation.
        Both 'source_conditions' and 'additional_conditions' are now
        saved as JSON blobs which represents a tree-like structure.
        Each tree node is represented in the following format:

        ```
        {operator: operand}
        ```

        Where "operator" is any of the following:

        ```
        For non-leaf nodes: 'AND' or 'OR'
        For leaf nodes: 'ANY_OF' or 'NONE_OF'
        ```

        The format for "operand" also depends on the type of node.

        For non-leaf nodes, use a list of children tree nodes of the form:

        ```
        [{operator: operand}, {operator: operand}, ...]
        ```

        For leaf nodes, use a dictionary of the form:

        ```
        {
          'field': <FIELD NAME>,
          'values': [{'value': [<VALUE>]}],
          'group': [{'value': [<GROUP ID>]}]
        }
        ```

        Stipulations on the format of the top-level tree structure
        is that the top-level operator must be an 'OR' node, with
        a single 'AND' node as the only child. The 'AND' node may have an arbitrary number
        of leaf node children. All valid Triage rules will look as follows:

        ```
        {
          'OR': [
            {
              'AND': [
                <LEAF NODE 1>,
                <LEAF NODE 2>,
                ...
                <LEAF NODE N>,
              ]
            }
          ]
        }
        ```

        Note 'source_conditions' and 'additional_conditions' have different fields
        that can be used in their leaf nodes. For 'source_conditions', the following
        fields are valid: ip, host, account, sensor. The fields 'ip' and 'host'
        also support triaging on groups, meaning that an IP or a host leaf node can
        be given an IP Group or Host Group ID, and the Triage rule will apply to
        every IP/host in the specified group. For 'additional_conditions', the following
        fields are valid: remote1_ip, remote1_proto, remote1_port, remote1_dns, remote2_ip,
        remote2_proto, remote2_port, remote2_dns, account, named_pipe, uuid,
        identity, share, extensions, rdp client name, rdp client token, keyboard name.
        The fields 'remote1_ip', 'remote2_ip', 'remote1_dns', 'remote2_dns' support
        triaging on groups. Either 'source_conditions' or 'additional_conditions' may
        be null. Setting source_conditions to null implies that this Triage rule with
        apply to All Hosts.
      operationId: v3.2_rule_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          $ref: '#/definitions/RuleRequestBodyV3'
      responses:
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error422PostRulesInvalidField'
              - $ref: '#/definitions/Error422PostRulesConditionsField'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Rules'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              data:
                $ref: '#/definitions/RuleSerializerV3'
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success status of operation. 
                    example: Success
                  message:
                    type: string
                    description: Message of success status of operation. 
                    example: "Successfully edited triage filter"
    delete:
      summary: Delete Rule
      tags:
      - v3.2/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint manages deleting rules from the system.
      operationId: v3.2_rule_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
        '400':
          description: Invalid query parameter requested.
          schema:
           $ref: '#/definitions/Error400InvalidParams'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
  /api/v3.2/detections/:
    get:
      summary: Get Detection List
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Detections are grouped into one of the following categories:
        | Detection Category  | URL |
        | -------- | ------- |
        | Command & Control  | /detections?detection_category=command    |
        | Botnet | /detections?detection_category=botnet     |
        | Reconnaissance    | /detections?detection_category=reconnaissance    |
        | Lateral Movement    | /detections?detection_category=lateral    |
        | Exfiltration    | /detections?detection_category=exfiltration    |
        | Info    | /detections?detection_category=info    |

        Please note that AWS imposes a 30 second timeout window for all requests. As a result, this endpoint may timeout when trying to query large amounts of complex detection data. If experiencing 504 responses, please try to adjust the number of detections returned by using the 'page_size' query parameter.

        The API query performs partial word match. For example, you can use /detections?
        detection_category=recon to query all Reconnaissance category detections.

      operationId: v3.2_detections_list
      parameters:
      - $ref: '#/components/parameters/DetectionsParamsV3/ordering'
      - $ref: '#/components/parameters/DetectionsParamsV3/page'
      - $ref: '#/components/parameters/DetectionsParamsV3/page_size'
      - $ref: '#/components/parameters/DetectionsParamsV3/category'
      - $ref: '#/components/parameters/DetectionsParamsV3/certainty'
      - $ref: '#/components/parameters/DetectionsParamsV3/certainty_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/c_score'
      - $ref: '#/components/parameters/DetectionsParamsV3/c_score_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/description'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection_type'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection_category'
      - $ref: '#/components/parameters/DetectionsParamsV3/exclude_fields'
      - $ref: '#/components/parameters/DetectionsParamsV3/fields'
      - $ref: '#/components/parameters/DetectionsParamsV3/host_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/host_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/id'
      - $ref: '#/components/parameters/DetectionsParamsV3/is_targeting_key_asset'
      - $ref: '#/components/parameters/DetectionsParamsV3/is_triaged'
      - $ref: '#/components/parameters/DetectionsParamsV3/last_timestamp'
      - $ref: '#/components/parameters/DetectionsParamsV3/last_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/min_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/max_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/note_modified_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/src_account'
      - $ref: '#/components/parameters/DetectionsParamsV3/src_account'
      - $ref: '#/components/parameters/DetectionsParamsV3/src_ip'
      - $ref: '#/components/parameters/DetectionsParamsV3/state'
      - $ref: '#/components/parameters/DetectionsParamsV3/tags'
      - $ref: '#/components/parameters/DetectionsParamsV3/targets_key_asset'
      - $ref: '#/components/parameters/DetectionsParamsV3/threat'
      - $ref: '#/components/parameters/DetectionsParamsV3/threat_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/t_score'
      - $ref: '#/components/parameters/DetectionsParamsV3/t_score_gte'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3.2/detections?page=3&page_size=1
              previous:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3.2/detections?page=1&page_size=1
              results:
                items:
                  $ref: '#/definitions/DetectionSerializerV3'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.2/detections
    parameters: []
    patch:
      summary: Mark Detections as Fixed
      description: |
        Marking a detection as Fixed indicates that some remedial action
        was taken based upon the detection.
        Threat and Certainty scores will both be 0 once a detection has been marked as fixed.
      operationId: v3.2_detections_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            detectionIdList:
              items:
                type: integer
                example: 1
              type: array
            mark_as_fixed:
              type: boolean
              example: true 
          required:
          - detectionIdList
          - mark_as_fixed
          type: object
      responses:
        '404':
          description: Not found error.
          schema:
            $ref: '#/definitions/Error404PatchDetections'
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422PatchDetections'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success flag for patch.
                    example: Success
                  message:
                    type: string
                    description: Operation message.
                    example: "Successfully marked detections"
      tags:
      - v3.2/detections
  /api/v3.2/detections/{id}/:
    get:
      summary: Get Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Detections are grouped into one of the following categories-
          * Command & Control
          * Botnet
          * Reconnaissance
          * Lateral Movement
          * Exfiltration
          * Info
      operationId: v3.2_detections_read
      parameters:
      - description: Fields to include in the response object.
        enum:
        - id
        - url
        - detection_url
        - category
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - t_score
        - c_score
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - targets_key_asset
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        - campaign_summaries
        - grouped_details
        - summary
        - is_triaged
        - src_linked_account
        in: query
        name: fields
        required: false
        type: string
      - description: Fields to exclude in the response object.
        enum:
        - id
        - url
        - detection_url
        - category
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - t_score
        - c_score
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - targets_key_asset
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        in: query
        name: exclude_fields
        required: false
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/DetectionSerializerV3'
      tags:
      - v3.2/detections
    parameters:
    - in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Edit Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Marking a detection as Fixed indicates that some remedial action was taken based upon the detection.
        Threat and Certainty scores will both be 0 once a detection has been marked as fixed.
      operationId: v3.2_detection_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            mark_as_fixed:
              type: boolean
              example: true
            note:
              type: string
              example: New note
            note_id:
              type: integer
              example: 1
            triageAs:
              type: string
              example: Benign Detection
          type: object
      responses:
        '422':
          description: Returned when request body is missing.
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: 'Returned when a triage filter has been created for the detection.'
        '200':
          description: 'Returned when a detection has been marked as fixed or a detection note has been updated.'
      tags:
      - v3.2/detections
  /api/v3.2/entities/:
    get:
      summary: Get Entity List
      description: |
        Entities is an overarching term to cover various types of models, including Accounts and Hosts.
        Entities are returned with an entity type, indicating what type of entity it is,
        along with urgency, importance, and fields from the original model.
      operationId: v3.2_entities_list
      parameters:
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/ordering'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/page'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/page_size'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/entity_type'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/exclude_fields'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/fields'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/id'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/is_prioritized'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/name'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/state'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/tags'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/EntitySerializerV3_1'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.2/entities
    parameters: []
  /api/v3.2/entities/{id}/:
    get:
      summary: Get Single Entity
      description: |
        Entities is an overarching term to cover various types of models, including Accounts and Hosts.
        Entities are returned with an entity type, indicating what type of entity it is,
        along with urgency, importance, and fields from the original model.
      operationId: v3.2_entities_read
      parameters:
      - $ref: '#/components/parameters/EntitiesReadParamsV3_1/entity_type'
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/EntitySerializerV3_1'
      tags:
      - v3.2/entities
    parameters:
    - in: path
      name: id
      required: true
      type: integer
  /api/v3.2/events/account_detection/:
    get:
      summary: Get Account Detection Events
      description: |
        Account Detection Events are generated upon initial detection and for each
        update of the detection.

        Example URL to retrieve account detection events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.2/events/account_detection?from=101`.
      operationId: v3.2_events_account_detection_list
      parameters:
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/account_uid'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/detection_id'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/from'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/include_info_category'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/include_triaged'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/ordering'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/since'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                items:
                  $ref: '#/definitions/DetectionEventSerializerV3'
                type: array
      tags:
      - v3.2/events
    parameters: []
  /api/v3.2/events/account_scoring/:
    get:
      summary: Get Account Scoring Events
      description: |
        Account Scoring Events are generated when an account score is changed, which occurs upon initial
        threat detection, discovery of additional detections, and updates to any discovered detections. The
        account score is reduced over time if the underlying detection behavior subsides, either because of user
        intervention or because the account has left the environment.

        Example URL to retrieve account scoring events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.2/events/account_scoring?from=101`.
      operationId: v3.2_events_account_scoring_list
      parameters:
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/account_uid'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/from'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/include_score_decreases'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/ordering'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/since'
      responses:
        '400':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/AccountScoringEventSerializerV3'
      tags:
      - v3.2/events
    parameters: []
  /api/v3.2/events/audits/:
    get:
      summary: Get Audit Log Events
      description: |
        Audit Log Events are generated when a user action is performed on the system. Audit Log Event are
        sequential and can be used to create an audit trail of user activity on your system.

        > NOTE: Audit events are persisted for 1 year.

        Example URL to retrieve audit events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.2/events/audits?from=101`.
      operationId: v3.2_events_audits_list
      parameters:
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_timestamp_lte'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/from'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/user_id'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_object'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_action'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/ordering'
      responses:
        '400':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/AuditEventSerializerV3'
      tags:
      - v3.2/events
    parameters: []
  /api/v3.2/events/entity_scoring/:
    get:
      summary: Get Entity Scoring Events
      description: |
        Entity Scoring Events are generated when an entity score is changed, which occurs upon initial threat
        detection, discovery of additional detections, and updates to any discovered detections. The entity
        score is reduced over time if the underlying detection behavior subsides, either because of user
        intervention or because the account has left the environment.

        Example URL to retrieve entity scoring events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.2/events/entity_scoring?from=101`.
      operationId: v3.2_events_entity_scoring_list
      parameters:
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_1/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_1/from'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_1/include_score_decreases'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_1/limit'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_1/ordering'
      responses:
        '404':
          description: 'Not found error.'
        '400':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/EntityScoringEventSerializerV3_1'
      tags:
      - v3.2/events
    parameters: []
  /api/v3.2/groups/:
    get:
      summary: Get Group List
      description: |
        The Groups API can retrieve a listing of groups that are defined on the system.

        Version 3.2 of Groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        Account Groups, but also create, modify, or delete them. Groups of type IP, Host, and Domain are
        not supported in this version of the API.
      operationId: v3.2_groups_list
      parameters:
      - $ref: '#/components/parameters/GroupsListParamsV3_2/ordering'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/page'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/page_size'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/account_ids'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/account_names'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/description'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/importance'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/last_modified_by'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/last_modified_timestamp'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/name'
      - $ref: '#/components/parameters/GroupsListParamsV3_2/type'

      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/GroupSerializerV3_2'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.2/groups
    parameters: []
    post:
      summary: Create Group
      description: |
        The groups API can retrieve a listing of groups that are defined on the system.

        Version 3.2 of groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        Account Groups, but also create, modify, or delete them. Groups of type IP, Host, and Domain are
        not supported in this version of the API.

        Use Account uids to assign Account Group membership.
      operationId: v3.2_groups_create
      parameters:
      requestBody:
        $ref: '#/components/requestBodies/GroupPostBodyV3_2'
      responses:
        '409':
          description: 'Name conflict error.'
          schema:
            $ref: '#/definitions/Error409PostGroups'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400InvalidJson'
            - $ref: '#/definitions/Error400InvalidBodyParam'
            - $ref: '#/definitions/Error400GroupsTypeV3_2'
        '422':
          description: 'Missing input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error422GroupsMissingBodyParam'
            - $ref: '#/definitions/Error422GroupsBody'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            properties:
              group:
                type: object
                properties:
                  id:
                    type: integer
                    example: 1
      tags:
      - v3.2/groups
  /api/v3.2/groups/{id}/:
    delete:
      summary: Delete Group
      description: |
        The groups API can retrieve a listing of groups that are defined on the system.

        Version 3.2 of groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        Account Groups, but also create, modify, or delete them. Groups of type IP, host, and domain are
        not supported in this version of the API.
      operationId: v3.2_groups_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422GroupsDelete'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400GroupsTypeV3_2'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.2/groups
    get:
      summary: Get Single Group
      description: |
        The groups API can retrieve a listing of groups that are defined on the system.

        Version 3.2 of groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        Account Groups, but also create, modify, or delete them. Groups of type IP, host, and domain are
        not supported in this version of the API.
      operationId: v3.2_groups_read
      parameters: []
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400GroupsTypeV3_2'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/GroupSerializerV3_2'
      tags:
      - v3.2/groups
    parameters:
    - description: A unique integer value identifying this group collection.
      in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Edit Group
      description: |
        The groups API can retrieve a listing of groups that are defined on the system.

        Version 3.2 of groups API supports GET, PATCH, POST, and DELETE to not only query the list of
        Account Groups, but also create, modify, or delete them. Groups of type IP, host, and domain are
        not supported in this version of the API.

        When using the default PATCH functionality to modify the members, a complete new list must be included. For
        example, if a group already contains accounts "acct1@test.com", and "acct2@test.com", and the group should be
        modified to include account "acct5@test.com", then "acct5@test.com" should be added to the list, the members
        field of the PATCH request should be "acct1@test.com","acct2@test.com","acct5@test.com".

        Alternatively, the "membership_action" query parameter can be passed in with a value of "replace", "append", or
        "remove". The "append" and "remove" values will only affect members listed in the request body; if a user wants to
        add or remove account "acct1@test.com" for a group, then the user can pass the members field of
        "acct1@test.com" in the request body with the appropriate value of "membership_action". The "replace" value will
        perform the default PATCH behavior.
      operationId: v3.2_groups_partial_update
      requestBody:
        $ref: '#/components/requestBodies/GroupPatchBodyV3_2'
      parameters:
      - in: body
        name: data
        required: true
      - description: Flag to specify the membership update to be performed. If this
          is not specified, the default action is membership replacement.
        enum:
        - remove
        - replace
        - append
        in: query
        name: membership_action
        required: false
        type: string
      responses:
        '409':
          description: 'Name conflict error.'
          schema:
            $ref: '#/definitions/Error409PostGroups'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400JsonParse'
              - $ref: '#/definitions/Error400InvalidBodyParam'
              - $ref: '#/definitions/Error400GroupsPatchTypeChange'
              - $ref: '#/definitions/Error400InvalidJson'
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error422GroupsPatchTypeV3_2'
            - $ref: '#/definitions/Error422GroupsBody'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/GroupSerializerV3_2'
      tags:
      - v3.2/groups
  /api/v3.2/tagging/{table}/:
    delete:
      summary: Bulk Delete Tag
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to delete a tag for a list of entities.
      operationId: v3.2_tagging_delete
      requestBody:
        $ref: '#/components/requestBodies/BulkTaggingBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400BulkInvalidTag'
        '404':
          description: Not found error.
          schema:
              $ref: '#/definitions/Error404BulkPatchTags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3.2/tagging
    parameters:
      - $ref: "#/components/parameters/TaggingParamsV3/table"
    post:
      summary: Bulk Create Tag
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to create a tag for a list of entities.
      operationId: v3.2_tagging_create
      requestBody:
        $ref: '#/components/requestBodies/BulkTaggingBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400BulkInvalidTag'
              - $ref: '#/definitions/Error400JsonParse'
        '404':
          description: Not found error.
          schema:
              $ref: '#/definitions/Error404BulkPatchTags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3.2/tagging
  /api/v3.2/tagging/{table}/{entity_id}/:
    get:
      summary: Get Entity Tag List
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to list tags for a single entity.
      operationId: v3.2_tagging_read
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Tags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TaggingSerializerV3'
      tags:
      - v3.2/tagging
    parameters:
      - $ref: "#/components/parameters/TaggingParamsV3/table"
      - $ref: "#/components/parameters/TaggingParamsV3/entity_id"
    patch:
      summary: Edit Entity Tag
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to replace all tags for an entity with a list of tags.
      operationId: v3.2_tagging_partial_update
      requestBody:
        $ref: '#/components/requestBodies/TaggingBodyV3'
      responses:
        '400':
          description: Invalid input error.
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400PatchTagsInvalidTagType'
              - $ref: '#/definitions/Error400PatchTagsInvalidTag'
              - $ref: '#/definitions/Error400JsonParse'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Tags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TaggingSerializerV3'
      tags:
      - v3.2/tagging
  /api/v3.2/{tvui_types}/{type_id}/notes/:
    get:
      summary: Get Entity Note List
      description: |
        An API client can list all of the Note objects associated with a single entity using this endpoint.
      operationId: v3.2_notes_list
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            items:
              $ref: '#/definitions/NoteSerializerV2_2'
            type: array
      tags:
      - v3.2/notes
    parameters:
      - $ref: '#/components/parameters/NotesParamsV3/tvui_types'
      - $ref: '#/components/parameters/NotesParamsV3/type_id'
    post:
      summary: Create Entity Note
      description: |
        An API client can use this endpoint to create a note for an entity.
      operationId: v3.2_notes_create
      requestBody:
        $ref: '#/components/requestBodies/NotesBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostNotes'
            - $ref: '#/definitions/Error400JsonParse'
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.2/notes
  /api/v3.2/{tvui_types}/{type_id}/notes/{note_id}/:
    delete:
      summary: Delete Entity Note
      description: |
        An API client can use this endpoint to delete a note for an entity.
      operationId: v3.2_notes_delete
      parameters:
      - description: The type of entity to tag
        enum:
        - accounts
        - detections
        in: path
        name: tvui_types
        required: true
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.2/notes
    get:
      summary: Get Entity Single Note
      description: |
        An API client can use this endpoint to view a note for an entity.
      operationId: v3.2_notes_read
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error404Generic'
              - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.2/notes
    parameters:
      - $ref: '#/components/parameters/NotesParamsV3/tvui_types'
      - $ref: '#/components/parameters/NotesParamsV3/type_id'
      - $ref: '#/components/parameters/NotesParamsV3/note_id'
    patch:
      summary: Edit Entity Note
      description: |
        An API client can use this endpoint to modify a note for an entity..
      operationId: v3.2_notes_partial_update
      requestBody:
        $ref: '#/components/requestBodies/NotesBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '400':
          description: 'Invalid input error for note.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostNotes'
            - $ref: '#/definitions/Error400JsonParse'
        '422':
          description: 'Invalid input error. Missing note param.'
          schema:
            $ref: '#/definitions/Error422PatchNoteMissingNote'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.2/notes
  /api/v3.1/accounts/:
    get:
      summary: Get Account List
      description: |
        Account objects contain information related to accounts observed in the environment.
      operationId: v3.1_accounts_list
      parameters:
        - $ref: '#/components/parameters/AccountsListParamsV3/ordering'
        - $ref: '#/components/parameters/AccountsListParamsV3/page'
        - $ref: '#/components/parameters/AccountsListParamsV3/page_size'
        - $ref: '#/components/parameters/AccountsListParamsV3/all'
        - $ref: '#/components/parameters/AccountsListParamsV3/c_score'
        - $ref: '#/components/parameters/AccountsListParamsV3/c_score_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/certainty'
        - $ref: '#/components/parameters/AccountsListParamsV3/certainty_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/exclude_fields'
        - $ref: '#/components/parameters/AccountsListParamsV3/fields'
        - $ref: '#/components/parameters/AccountsListParamsV3/first_seen'
        - $ref: '#/components/parameters/AccountsListParamsV3/id'
        - $ref: '#/components/parameters/AccountsListParamsV3/include_detection_summaries'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_detection_timestamp_lte'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_seen'
        - $ref: '#/components/parameters/AccountsListParamsV3/max_id'
        - $ref: '#/components/parameters/AccountsListParamsV3/min_id'
        - $ref: '#/components/parameters/AccountsListParamsV3/name'
        - $ref: '#/components/parameters/AccountsListParamsV3/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_category'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_level'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_level_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/state'
        - $ref: '#/components/parameters/AccountsListParamsV3/t_score'
        - $ref: '#/components/parameters/AccountsListParamsV3/t_score_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/tags'
        - $ref: '#/components/parameters/AccountsListParamsV3/threat'
        - $ref: '#/components/parameters/AccountsListParamsV3/threat_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/uid'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/AccountSerializerV3'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.1/accounts
    parameters: []
  /api/v3.1/accounts/{id}/:
    get:
      summary: Get Single Account
      description: |
        Account objects contain information related to accounts observed in the environment.
      operationId: v3.1_accounts_read
      parameters:
        - $ref: '#/components/parameters/AccountsReadParamsV3/exclude_fields'
        - $ref: '#/components/parameters/AccountsReadParamsV3/fields'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_access_history'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_detection_summaries'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_external'
        - $ref: '#/components/parameters/AccountsReadParamsV3/src_linked_account'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/SingleAccountSerializerV3'
      tags:
      - v3.1/accounts
    parameters:
    - in: path
      name: id
      required: true
      type: integer
  /api/v3.1/assignment_outcomes/:
    get:
      summary: Get Assignment Outcome List
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        This information includes but is not limited to:
          *	ID
          *	Title
          *	Category
      operationId: v3.1_assignment_outcomes_list
      parameters:
        - description: A page number within the paginated result set.
          in: query
          name: page
          required: false
          type: integer
          example: 1
          minimum: 1
        - description: Number of results to return per page.
          in: query
          name: page_size
          required: false
          type: integer
          minimum: 1
          example: 5
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/AssignmentOutcome'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.1/assignment_outcomes
    parameters: []
    post:
      summary: Create Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can create an outcome using this endpoint.
      operationId: v3.1_assignment_outcomes_create
      requestBody:
        $ref: '#/components/requestBodies/AssignmentOutcomePostBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignmentOutcomes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.1/assignment_outcomes
  /api/v3.1/assignment_outcomes/{id}/:
    delete:
      summary: Delete Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can delete an outcome using this endpoint.
      operationId: v3.1_assignment_outcomes_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400DeleteAssignmentOutcome'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.1/assignment_outcomes
    get:
      summary: Get Single Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        This information includes but is not limited to:
          *	ID
          *	Title
          *	Category
      operationId: v3.1_assignment_outcomes_read
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.1/assignment_outcomes
    parameters:
    - description: A unique integer value identifying this assignment outcome.
      in: path
      name: id
      required: true
      type: integer
      example: 1
      minimum: 1
    put:
      summary: Edit Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can modify an outcome using this endpoint.
      operationId: v3.1_assignment_outcomes_partial_update
      requestBody:
        $ref: '#/components/requestBodies/AssignmentOutcomePatchBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignmentOutcomes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3.1/assignment_outcomes
  /api/v3.1/assignments/:
    get:
      summary: Get Assignment List
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        This information includes but is not limited to:
          * Assigned to user
          * Assigned by user
          * Date assigned
          * Date resolved
          * Events
          * Outcome
          * Account ID
          * Triaged detections
      operationId: v3.1_assignments_list
      parameters:
        - $ref: '#/components/parameters/AssignmentsListParamsV3/page'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/page_size'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/accounts'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/assignees'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/created_after'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/hosts'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/resolution'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/resolved'
      responses:
        '400':
          description: Invalid query parameter, parameter value, or authorization error.
          schema:
           oneOf:
            - $ref: '#/definitions/Error400GetAssignments'
            - $ref: '#/definitions/Error400InvalidParams'
            - $ref: '#/definitions/Error400InvalidParamValue'
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/Assignment'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.1/assignments
    post:
      summary: Create Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        The creation of assignments is handled by this endpoint.
      operationId: v3.1_assignments_create
      requestBody:
        $ref: '#/components/requestBodies/AssignmentPostBodyV3'
      responses:
        '400':
          description: "Invalid input error."
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignments'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.1/assignments
  /api/v3.1/assignments/{id}/:
    delete:
      summary: Delete Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        This endpoint handles deleting a single assignment.
      operationId: v3.1_assignments_delete
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.1/assignments
    get:
      summary: Get Single Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        This information includes but is not limited to:
          * Assigned to user
          * Assigned by user
          * Date assigned
          * Date resolved
          * Events
          * Outcome
          * Account ID
          * Triaged detections
      operationId: v3.1_assignments_read
      responses:
        '400':
          description: 'Invalid query parameter.'
          schema:
            $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.1/assignments
    parameters:
      - $ref: "#/components/parameters/AssignmentsReadParamsV3/id"
    put:
      summary: Edit Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.

        An API client can modify the user and/or account associated to an assignment using this endpoint.
      operationId: v3.1_assignments_update
      requestBody:
        $ref: '#/components/requestBodies/AssignmentPutBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: "Invalid input error."
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignments'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.1/assignments
  /api/v3.1/assignments/{id}/resolve/:
    parameters:
      - $ref: "#/components/parameters/AssignmentsReadParamsV3/id"
    put:
      summary: Resolve Assignment
      description: |
        Once completed, assignments can be resolved. Assignment resolutions provide a way to label and track
        the outcomes of assignments. Outcomes get recorded in the assignment's history.

        Outcome choices may include one of the following built-in assignment outcomes:
          * Benign True Positive
          * Malicious True Positive
          * False Positive

        Alternatively, users can choose to define their own Custom outcomes for reporting purposes.
      operationId: v3.1_assignments_resolve
      requestBody:
        $ref: '#/components/requestBodies/AssignmentsResolveBodyV3'
      responses:
        '409':
          description: 'Conflict error, assignment hsa already been resolved.'
          schema:
            $ref: '#/definitions/Error409ResolveAssignments'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: Invalid input error.
          schema:
            oneOf:
            - $ref: '#/definitions/Error400ResolveAssignmentsDetectionIDs'
            - $ref: '#/definitions/Error400ResolveAssignmentsOutcome'
            - $ref: '#/definitions/Error400ResolveAssignmentsTriageAs'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3.1/assignments
  /api/v3.1/rules/:
    get:
      summary: Get Rule List
      tags:
      - v3.1/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint lists the existing Triage Rules in the system.
      operationId: v3.1_rules_list
      parameters:
        - $ref: '#/components/parameters/Common/ordering'
        - $ref: '#/components/parameters/Common/page'
        - $ref: '#/components/parameters/Common/page_size'
        - $ref: '#/components/parameters/RulesParamsV3/contains'
        - $ref: '#/components/parameters/RulesParamsV3/fields'
        - $ref: '#/components/parameters/RulesParamsV3/include_templates'
      responses:
        '404':
            description: The requested page does not exist. Reduce the requested page.
            schema:
              $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/RuleSerializerV3'
                type: array
    post:
      summary: Create Rule
      tags:
      - v3.1/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This path's POST method supports two different creation tasks
        depending on the request body.

        **Task A**

        When specifying a new triage category in the request body
        without a detection list, this endpoint creates new Triage Rules.

        The following format is required for source_conditions
        and additional_conditions in the request body:

        The format for Triage rules is based on AND/OR logic,
        making them more flexible and customizable to your specific situation.
        Both 'source_conditions' and 'additional_conditions' are now
        saved as JSON blobs which represents a tree-like structure.
        Each tree node is represented in the following format:

        ```
        {operator: operand}
        ```

        Where "operator" is any of the following:

        ```
        For non-leaf nodes: 'AND' or 'OR'
        For leaf nodes: 'ANY_OF' or 'NONE_OF'
        ```

        The format for "operand" also depends on the type of node.

        For non-leaf nodes, use a list of children tree nodes of the form:

        ```
        [{operator: operand}, {operator: operand}, ...]
        ```

        For leaf nodes, use a dictionary of the form:

        ```
        {
          'field': <FIELD NAME>,
          'values': [{'value': [<VALUE>]}],
          'group': [{'value': [<GROUP ID>]}]
        }
        ```

        Stipulations on the format of the top-level tree structure
        is that the top-level operator must be an 'OR' node, with
        a single 'AND' node as the only child. The 'AND' node may have an arbitrary number
        of leaf node children. All valid Triage rules will look as follows:

        ```
        {
          'OR': [
            {
              'AND': [
                <LEAF NODE 1>,
                <LEAF NODE 2>,
                ...
                <LEAF NODE N>,
              ]
            }
          ]
        }
        ```

        Note 'source_conditions' and 'additional_conditions' have different fields
        that can be used in their leaf nodes. For 'source_conditions', the following
        fields are valid: ip, host, account, sensor. The fields 'ip' and 'host'
        also support triaging on groups, meaning that an IP or a host leaf node can
        be given an IP Group or Host Group ID, and the Triage rule will apply to
        every IP/host in the specified group. For 'additional_conditions', the following
        fields are valid: remote1_ip, remote1_proto, remote1_port, remote1_dns, remote2_ip,
        remote2_proto, remote2_port, remote2_dns, account, named_pipe, uuid,
        identity, share, extensions, rdp client name, rdp client token, keyboard name.
        The fields 'remote1_ip', 'remote2_ip', 'remote1_dns', 'remote2_dns' support
        triaging on groups. Either 'source_conditions' or 'additional_conditions' may
        be null. Setting source_conditions to null implies that this Triage rule with
        apply to All Hosts.

        **Task B**

        The POST Triage Rules endpoint can be used with a
        request body specifying detection ids and a triage category
        to filter a set of detections under the chosen triage category
      operationId: v3.1_rules_create
      parameters:
      - in: body
        name: data
        required: true
        schema:
          oneOf:
          - title: Task A
            description: The schema for Task A.
            $ref: '#/definitions/RuleRequestBodyV3'
          - type: object
            title: Task B
            description: The schema for Task B.
            properties:
              detectionIdList:
                description: Detections ids to add to triage rule filter.
                items:
                  type: integer
                  example: 1
                type: array
              triage_category:
                type: string
                description: Custom Triage label used to categorize specified detections.
                example: Benign Detection
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400JsonParse'
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error422PostRulesInvalidField'
              - $ref: '#/definitions/Error422PostRulesConditionsField'
              - $ref: '#/definitions/Error422PostRulesDetectionList'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            oneOf:
            - type: object
              title: Task A
              description: The response for Task A.
              properties:
                id:
                  type: integer
                  description: Rule ID. 
                  example: 1
                _meta:
                  type: object
                  properties:
                    level:
                      type: string
                      description: Success status of operation. 
                      example: Success
                    message:
                      type: string
                      description: Message of success status of operation. 
                      example: "Successfully created triage filter"
            - type: object
              title: Task B
              description: The response for Task B.
              properties:
                ids:
                  type: array
                  items:
                    type: integer
                    example: 1
                  description: Rule IDs. 
                _meta:
                  type: object
                  properties:
                    level:
                      type: string
                      description: Success status of operation. 
                      example: Success
                    message:
                      type: string
                      description: Message of success status of operation. 
                      example: "Successfully created triage filter"
    delete:
      summary: Delete Detections Rule
      tags:
      - v3.1/rules
      description: |
        The DELETE Triage Rules endpoint can be used with the following
        request body to remove triage filters for a set of detections.
      operationId: v3.1_detection_rules_delete
      parameters:
      - in: body
        name: data
        required: true
        schema:
          type: object
          properties:
            detectionIdList:
              description: Detections ids to remove triage rule filters.
              items:
                type: integer
                example: 1
              type: array
      responses:
        '422':
          description: Invalid input for detectionIdList.
          schema:
            $ref: '#/definitions/Error422DeleteRulesDetectionList'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
  /api/v3.1/rules/{rule_id}/:
    parameters:
    - in: path
      name: rule_id
      required: true
      type: integer
      description: The rule ID. 
    get:
      summary: Get Single Rule
      tags:
      - v3.1/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint lists a single Triage Rules in the system.
      operationId: v3_1_rule_read
      parameters:
      - description: Which field to use when ordering the results.
        in: query
        name: fields
        required: false
        type: string
        enum:
        - id
        - url
        - description
        - enabled
        - created_timestamp
        - last_timestamp
        - is_whitelist
        - priority
        - active_detections
        - total detections
        - template
        - additional_conditions
        - source_condition
        - detection
        - detection_category
        - triage_category
      responses:
        '400':
          description: Invalid query parameter requested.
          schema:
           $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/RuleSerializerV3'
    put:
      summary: Edit Rule
      tags:
      - v3.1/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint manages updating Triage Rules.

        The following format is required for source_conditions
        and additional_conditions in the request body:

        The format for Triage rules is based on AND/OR logic,
        making them more flexible and customizable to your specific situation.
        Both 'source_conditions' and 'additional_conditions' are now
        saved as JSON blobs which represents a tree-like structure.
        Each tree node is represented in the following format:

        ```
        {operator: operand}
        ```

        Where "operator" is any of the following:

        ```
        For non-leaf nodes: 'AND' or 'OR'
        For leaf nodes: 'ANY_OF' or 'NONE_OF'
        ```

        The format for "operand" also depends on the type of node.

        For non-leaf nodes, use a list of children tree nodes of the form:

        ```
        [{operator: operand}, {operator: operand}, ...]
        ```

        For leaf nodes, use a dictionary of the form:

        ```
        {
          'field': <FIELD NAME>,
          'values': [{'value': [<VALUE>]}],
          'group': [{'value': [<GROUP ID>]}]
        }
        ```

        Stipulations on the format of the top-level tree structure
        is that the top-level operator must be an 'OR' node, with
        a single 'AND' node as the only child. The 'AND' node may have an arbitrary number
        of leaf node children. All valid Triage rules will look as follows:

        ```
        {
          'OR': [
            {
              'AND': [
                <LEAF NODE 1>,
                <LEAF NODE 2>,
                ...
                <LEAF NODE N>,
              ]
            }
          ]
        }
        ```

        Note 'source_conditions' and 'additional_conditions' have different fields
        that can be used in their leaf nodes. For 'source_conditions', the following
        fields are valid: ip, host, account, sensor. The fields 'ip' and 'host'
        also support triaging on groups, meaning that an IP or a host leaf node can
        be given an IP Group or Host Group ID, and the Triage rule will apply to
        every IP/host in the specified group. For 'additional_conditions', the following
        fields are valid: remote1_ip, remote1_proto, remote1_port, remote1_dns, remote2_ip,
        remote2_proto, remote2_port, remote2_dns, account, named_pipe, uuid,
        identity, share, extensions, rdp client name, rdp client token, keyboard name.
        The fields 'remote1_ip', 'remote2_ip', 'remote1_dns', 'remote2_dns' support
        triaging on groups. Either 'source_conditions' or 'additional_conditions' may
        be null. Setting source_conditions to null implies that this Triage rule with
        apply to All Hosts.
      operationId: v3.1_rule_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          $ref: '#/definitions/RuleRequestBodyV3'
      responses:
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error422PostRulesInvalidField'
              - $ref: '#/definitions/Error422PostRulesConditionsField'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Rules'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              data:
                $ref: '#/definitions/RuleSerializerV3'
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success status of operation. 
                    example: Success
                  message:
                    type: string
                    description: Message of success status of operation. 
                    example: "Successfully edited triage filter"
    delete:
      summary: Delete Rule
      tags:
      - v3.1/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint manages deleting rules from the system.
      operationId: v3.1_rule_delete
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
        '400':
          description: Invalid query parameter requested.
          schema:
           $ref: '#/definitions/Error400InvalidParams'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
  /api/v3.1/detections/:
    get:
      summary: Get Detection List
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Detections are grouped into one of the following categories:
        | Detection Category  | URL |
        | -------- | ------- |
        | Command & Control  | /detections?detection_category=command    |
        | Botnet | /detections?detection_category=botnet     |
        | Reconnaissance    | /detections?detection_category=reconnaissance    |
        | Lateral Movement    | /detections?detection_category=lateral    |
        | Exfiltration    | /detections?detection_category=exfiltration    |
        | Info    | /detections?detection_category=info    |

        Please note that AWS imposes a 30 second timeout window for all requests. As a result, this endpoint may timeout when trying to query large amounts of complex detection data. If experiencing 504 responses, please try to adjust the number of detections returned by using the 'page_size' query parameter.

        The API query performs partial word match. For example, you can use /detections?
        detection_category=recon to query all Reconnaissance category detections.

      operationId: v3.1_detections_list
      parameters:
      - $ref: '#/components/parameters/DetectionsParamsV3/ordering'
      - $ref: '#/components/parameters/DetectionsParamsV3/page'
      - $ref: '#/components/parameters/DetectionsParamsV3/page_size'
      - $ref: '#/components/parameters/DetectionsParamsV3/category'
      - $ref: '#/components/parameters/DetectionsParamsV3/certainty'
      - $ref: '#/components/parameters/DetectionsParamsV3/certainty_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/c_score'
      - $ref: '#/components/parameters/DetectionsParamsV3/c_score_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/description'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection_type'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection_category'
      - $ref: '#/components/parameters/DetectionsParamsV3/exclude_fields'
      - $ref: '#/components/parameters/DetectionsParamsV3/fields'
      - $ref: '#/components/parameters/DetectionsParamsV3/host_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/id'
      - $ref: '#/components/parameters/DetectionsParamsV3/is_targeting_key_asset'
      - $ref: '#/components/parameters/DetectionsParamsV3/is_triaged'
      - $ref: '#/components/parameters/DetectionsParamsV3/last_timestamp'
      - $ref: '#/components/parameters/DetectionsParamsV3/last_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/min_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/max_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/note_modified_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/src_account'
      - $ref: '#/components/parameters/DetectionsParamsV3/src_ip'
      - $ref: '#/components/parameters/DetectionsParamsV3/state'
      - $ref: '#/components/parameters/DetectionsParamsV3/tags'
      - $ref: '#/components/parameters/DetectionsParamsV3/targets_key_asset'
      - $ref: '#/components/parameters/DetectionsParamsV3/threat'
      - $ref: '#/components/parameters/DetectionsParamsV3/threat_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/t_score'
      - $ref: '#/components/parameters/DetectionsParamsV3/t_score_gte'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3.1/detections?page=3&page_size=1
              previous:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3.1/detections?page=1&page_size=1
              results:
                items:
                  $ref: '#/definitions/DetectionSerializerV3'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.1/detections
    parameters: []
    patch:
      summary: Mark Detections as Fixed
      description: |
        Marking a detection as Fixed indicates that some remedial action was taken based upon the detection.
        Threat and Certainty scores will both be 0 once a detection has been marked as fixed.
      operationId: v3.1_detections_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            detectionIdList:
              items:
                type: integer
                example: 1
              type: array
            mark_as_fixed:
              type: boolean
              example: true 
          required:
          - detectionIdList
          - mark_as_fixed
          type: object
      responses:
        '404':
          description: Not found error.
          schema:
            $ref: '#/definitions/Error404PatchDetections'
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422PatchDetections'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success flag for patch.
                    example: Success
                  message:
                    type: string
                    description: Operation message.
                    example: "Successfully marked detections"
      tags:
      - v3.1/detections
  /api/v3.1/detections/{id}/:
    get:
      summary: Get Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Detections are grouped into one of the following categories-
          * Command & Control
          * Botnet
          * Reconnaissance
          * Lateral Movement
          * Exfiltration
          * Info
      operationId: v3.1_detections_read
      parameters:
      - description: Fields to include in the response object.
        enum:
        - id
        - url
        - detection_url
        - category
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - t_score
        - c_score
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - targets_key_asset
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        - campaign_summaries
        - grouped_details
        - summary
        - is_triaged
        - src_linked_account
        in: query
        name: fields
        required: false
        type: string
      - description: Fields to exclude in the response object.
        enum:
        - id
        - url
        - detection_url
        - category
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - t_score
        - c_score
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - targets_key_asset
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        in: query
        name: exclude_fields
        required: false
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/DetectionSerializerV3'
      tags:
      - v3.1/detections
    parameters:
    - in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Edit Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Marking a detection as Fixed indicates that some remedial action was taken based upon the detection.
        Threat and Certainty scores will both be 0 once a detection has been marked as fixed.
      operationId: v3.1_detection_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            mark_as_fixed:
              type: boolean
              example: true 
            note:
              type: string
              example: Example note
            note_id:
              type: integer
              example: 1
            triageAs:
              type: string
              example: Benign Detection
          type: object
      responses:
        '422':
          description: Returned when request body is missing.
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: 'Returned when a triage filter has been created for the detection.'
        '200':
          description: 'Returned when a detection has been marked as fixed or a detection note has been updated.'
      tags:
      - v3.1/detections
  /api/v3.1/entities/:
    get:
      summary: Get Entity List
      description: |
        Entities is an overarching term to cover various types of models, including Accounts and Hosts.
        Entities are returned with an entity type, indicating what type of entity it is,
        along with urgency, importance, and fields from the original model.
      operationId: v3.1_entities_list
      parameters:
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/ordering'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/page'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/page_size'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/entity_type'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/exclude_fields'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/fields'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/id'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/is_prioritized'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/name'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/state'
        - $ref: '#/components/parameters/EntitiesListParamsV3_1/tags'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/EntitySerializerV3_1'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3.1/entities
    parameters: []
  /api/v3.1/entities/{id}/:
    get:
      summary: Get Single Entity
      description: |
        Entities is an overarching term to cover various types of models, including Accounts and Hosts.
        Entities are returned with an entity type, indicating what type of entity it is,
        along with urgency, importance, and fields from the original model.
      operationId: v3.1_entities_read
      parameters:
      - $ref: '#/components/parameters/EntitiesReadParamsV3_1/entity_type'
      responses:
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
              - $ref: '#/definitions/Error400EntitiesMissingTypeParam'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/EntitySerializerV3_1'
      tags:
      - v3.1/entities
    parameters:
    - in: path
      name: id
      required: true
      type: integer
  /api/v3.1/events/account_detection/:
    get:
      summary: Get Account Detection Events
      description: |
        Account Detection Events are generated upon initial detection and for each
        update of the detection.

        Example URL to retrieve account detection events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.1/events/account_detection?from=101`.
      operationId: v3.1_events_account_detection_list
      parameters:
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/account_uid'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/detection_id'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/from'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/include_info_category'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/include_triaged'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/ordering'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/since'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/DetectionEventSerializerV3'
      tags:
      - v3.1/events
    parameters: []
  /api/v3.1/events/account_scoring/:
    get:
      summary: Get Account Scoring Events
      description: |
        Account Scoring Events are generated when an account score is changed, which occurs upon initial
        threat detection, discovery of additional detections, and updates to any discovered detections. The
        account score is reduced over time if the underlying detection behavior subsides, either because of user
        intervention or because the account has left the environment.

        Example URL to retrieve account scoring events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.1/events/account_scoring?from=101`.
      operationId: v3.1_events_account_scoring_list
      parameters:
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/account_uid'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/from'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/include_score_decreases'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/ordering'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/since'
      responses:
        '400':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/AccountScoringEventSerializerV3'
      tags:
      - v3.1/events
    parameters: []
  /api/v3.1/events/audits/:
    get:
      summary: Get Audit Log Events
      description: |
        Audit Log Events are generated when a user action is performed on the system. Audit Log Event are
        sequential and can be used to create an audit trail of user activity on your system.

        > NOTE: Audit events are persisted for 1 year.

        Example URL to retrieve audit events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.1/events/audits?from=101`.
      operationId: v3.1_events_audits_list
      parameters:
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_timestamp_lte'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/from'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/user_id'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_object'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_action'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/ordering'
      responses:
        '400':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/AuditEventSerializerV3'
      tags:
      - v3.1/events
    parameters: []
  /api/v3.1/events/entity_scoring/:
    get:
      summary: Get Entity Scoring Events
      description: |
        Entity Scoring Events are generated when an entity score is changed, which occurs upon initial threat
        detection, discovery of additional detections, and updates to any discovered detections. The entity
        score is reduced over time if the underlying detection behavior subsides, either because of user
        intervention or because the account has left the environment.

        Example URL to retrieve entity scoring events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3.1/events/entity_scoring?from=101`.
      operationId: v3.1_events_entity_scoring_list
      parameters:
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_1/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_1/from'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_1/include_score_decreases'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_1/limit'
        - $ref: '#/components/parameters/EventsEntityScoringListParamsV3_1/ordering'
      responses:
        '404':
          description: 'Not found error.'
        '400':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/EntityScoringEventSerializerV3_1'
      tags:
      - v3.1/events
    parameters: []
  /api/v3.1/tagging/{table}/:
    delete:
      summary: Bulk Delete Tag
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to delete a tag for a list of entities.
      operationId: v3.1_tagging_delete
      requestBody:
        $ref: '#/components/requestBodies/BulkTaggingBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400BulkInvalidTag'
        '404':
          description: Not found error.
          schema:
              $ref: '#/definitions/Error404BulkPatchTags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3.1/tagging
    parameters:
       - $ref: "#/components/parameters/TaggingParamsV3/table"
    post:
      summary: Bulk Create Tag
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to create a tag for a list of entities.
      operationId: v3.1_tagging_create
      requestBody:
        $ref: '#/components/requestBodies/BulkTaggingBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400BulkInvalidTag'
              - $ref: '#/definitions/Error400JsonParse'
        '404':
          description: Not found error.
          schema:
              $ref: '#/definitions/Error404BulkPatchTags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3.1/tagging
  /api/v3.1/tagging/{table}/{entity_id}/:
    get:
      summary: Get Entity Tag List
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to list tags for a single entity.
      operationId: v3.1_tagging_read
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Tags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TaggingSerializerV3'
      tags:
      - v3.1/tagging
    parameters:
      - $ref: "#/components/parameters/TaggingParamsV3/table"
      - $ref: "#/components/parameters/TaggingParamsV3/entity_id"
    patch:
      summary: Edit Entity Tag
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to replace all tags for an entity with a list of tags.
      operationId: v3.1_tagging_partial_update
      requestBody:
        $ref: '#/components/requestBodies/TaggingBodyV3'
      responses:
        '400':
          description: Invalid input error.
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400PatchTagsInvalidTagType'
              - $ref: '#/definitions/Error400PatchTagsInvalidTag'
              - $ref: '#/definitions/Error400JsonParse'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Tags'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TaggingSerializerV3'
      tags:
      - v3.1/tagging
  /api/v3.1/{tvui_types}/{type_id}/notes/:
    get:
      summary: Get Entity Note List
      description: |
        An API client can list all of the Note objects associated with a single entity using this endpoint.
      operationId: v3.1_notes_list
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            items:
              $ref: '#/definitions/NoteSerializerV2_2'
            type: array
      tags:
      - v3.1/notes
    parameters:
      - $ref: '#/components/parameters/NotesParamsV3/tvui_types'
      - $ref: '#/components/parameters/NotesParamsV3/type_id'
    post:
      summary: Create Entity Note
      description: |
        An API client can use this endpoint to create a note for an entity.
      operationId: v3.1_notes_create
      requestBody:
        $ref: '#/components/requestBodies/NotesBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostNotes'
            - $ref: '#/definitions/Error400JsonParse'
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.1/notes
  /api/v3.1/{tvui_types}/{type_id}/notes/{note_id}/:
    delete:
      summary: Delete Entity Note
      description: |
        An API client can use this endpoint to delete a note for an entity.
      operationId: v3.1_notes_delete
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
      tags:
      - v3.1/notes
    get:
      summary: Get Entity Single Note
      description: |
        An API client can use this endpoint to view a note for an entity.
      operationId: v3.1_notes_read
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error404Generic'
              - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.1/notes
    parameters:
      - $ref: '#/components/parameters/NotesParamsV3/tvui_types'
      - $ref: '#/components/parameters/NotesParamsV3/type_id'
      - $ref: '#/components/parameters/NotesParamsV3/note_id'
    patch:
      summary: Edit Entity Note
      description: |
        An API client can use this endpoint to modify a note for an entity.
      operationId: v3.1_notes_partial_update
      requestBody:
        $ref: '#/components/requestBodies/NotesBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '400':
          description: 'Invalid input error for note.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostNotes'
            - $ref: '#/definitions/Error400JsonParse'
        '422':
          description: 'Invalid input error. Missing note param.'
          schema:
            $ref: '#/definitions/Error422PatchNoteMissingNote'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3.1/notes
  /api/v3/accounts/:
    get:
      summary: Get Account List
      description: |
        Account objects contain information related to accounts observed in the environment.
      operationId: v3_accounts_list
      parameters:
        - $ref: '#/components/parameters/AccountsListParamsV3/ordering'
        - $ref: '#/components/parameters/AccountsListParamsV3/page'
        - $ref: '#/components/parameters/AccountsListParamsV3/page_size'
        - $ref: '#/components/parameters/AccountsListParamsV3/all'
        - $ref: '#/components/parameters/AccountsListParamsV3/c_score'
        - $ref: '#/components/parameters/AccountsListParamsV3/c_score_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/certainty'
        - $ref: '#/components/parameters/AccountsListParamsV3/certainty_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/exclude_fields'
        - $ref: '#/components/parameters/AccountsListParamsV3/fields'
        - $ref: '#/components/parameters/AccountsListParamsV3/first_seen'
        - $ref: '#/components/parameters/AccountsListParamsV3/id'
        - $ref: '#/components/parameters/AccountsListParamsV3/include_detection_summaries'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_detection_timestamp_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_detection_timestamp_lte'
        - $ref: '#/components/parameters/AccountsListParamsV3/last_seen'
        - $ref: '#/components/parameters/AccountsListParamsV3/max_id'
        - $ref: '#/components/parameters/AccountsListParamsV3/min_id'
        - $ref: '#/components/parameters/AccountsListParamsV3/name'
        - $ref: '#/components/parameters/AccountsListParamsV3/note_modified_timestamp_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_category'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_level'
        - $ref: '#/components/parameters/AccountsListParamsV3/privilege_level_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/state'
        - $ref: '#/components/parameters/AccountsListParamsV3/t_score'
        - $ref: '#/components/parameters/AccountsListParamsV3/t_score_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/tags'
        - $ref: '#/components/parameters/AccountsListParamsV3/threat'
        - $ref: '#/components/parameters/AccountsListParamsV3/threat_gte'
        - $ref: '#/components/parameters/AccountsListParamsV3/uid'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/AccountSerializerV3'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3/accounts
    parameters: []
  /api/v3/accounts/{id}/:
    get:
      summary: Get Single Account
      description: |
        Account objects contain information related to accounts observed in the environment.
      operationId: v3_accounts_read
      parameters:
        - $ref: '#/components/parameters/AccountsReadParamsV3/exclude_fields'
        - $ref: '#/components/parameters/AccountsReadParamsV3/fields'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_access_history'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_detection_summaries'
        - $ref: '#/components/parameters/AccountsReadParamsV3/include_external'
        - $ref: '#/components/parameters/AccountsReadParamsV3/src_linked_account'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/SingleAccountSerializerV3'
      tags:
      - v3/accounts
    parameters:
    - in: path
      name: id
      required: true
      type: integer
  /api/v3/assignment_outcomes/:
    get:
      summary: Get Assignment Outcome List
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        This information includes but is not limited to:
          *	ID
          *	Title
          *	Category
      operationId: v3_assignment_outcomes_list
      parameters:
        - description: A page number within the paginated result set.
          in: query
          name: page
          required: false
          type: integer
          example: 1
          minimum: 1
        - description: Number of results to return per page.
          in: query
          name: page_size
          required: false
          type: integer
          minimum: 1
          example: 5
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage' 
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/AssignmentOutcome'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3/assignment_outcomes
    parameters: []
    post:
      summary: Create Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can create an outcome using this endpoint.
      operationId: v3_assignment_outcomes_create
      requestBody:
        $ref: '#/components/requestBodies/AssignmentOutcomePostBodyV3'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignmentOutcomes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3/assignment_outcomes
  /api/v3/assignment_outcomes/{id}/:
    delete:
      summary: Delete Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can delete an outcome using this endpoint.
      operationId: v3_assignment_outcomes_delete
      parameters: []
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400DeleteAssignmentOutcome'
      tags:
      - v3/assignment_outcomes
    get:
      summary: Get Single Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        This information includes but is not limited to:
          *	ID
          *	Title
          *	Category
      operationId: v3_assignment_outcomes_read
      parameters: []
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3/assignment_outcomes
    parameters:
    - description: A unique integer value identifying this assignment outcome.
      in: path
      name: id
      required: true
      type: integer
      example: 1
      minimum: 1
    put:
      summary: Edit Assignment Outcome
      description: |
        Assignment outcomes are used to label resolution outcomes for assignments.
        
        An API client can modify an outcome using this endpoint.
      operationId: v3_assignment_outcomes_partial_update
      requestBody:
        $ref: '#/components/requestBodies/AssignmentOutcomePatchBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignmentOutcomes'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/AssignmentOutcome'
      tags:
      - v3/assignment_outcomes
  /api/v3/assignments/:
    get:
      summary: Get Assignment List
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        This information includes but is not limited to:
          * Assigned to user
          * Assigned by user
          * Date assigned
          * Date resolved
          * Events
          * Outcome
          * Account ID
          * Triaged detections
      operationId: v3_assignments_list
      parameters:
        - $ref: '#/components/parameters/AssignmentsListParamsV3/page'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/page_size'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/accounts'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/assignees'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/created_after'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/hosts'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/resolution'
        - $ref: '#/components/parameters/AssignmentsListParamsV3/resolved'
      responses:
        '400':
          description: Invalid query parameter, parameter value, or authorization error.
          schema:
           oneOf:
            - $ref: '#/definitions/Error400GetAssignments'
            - $ref: '#/definitions/Error400InvalidParams'
            - $ref: '#/definitions/Error400InvalidParamValue'
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/Assignment'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3/assignments
    post:
      summary: Create Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        The creation of assignments is handled by this endpoint.
      operationId: v3_assignments_create
      requestBody:
        $ref: '#/components/requestBodies/AssignmentPostBodyV3'
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
        '400':
          description: "Invalid input error."
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignments'
            - $ref: '#/definitions/Error400JsonParse'
      tags:
      - v3/assignments
  /api/v3/assignments/{id}/:
    delete:
      summary: Delete Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        This endpoint handles deleting a single assignment.
      operationId: v3_assignments_delete
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
      tags:
      - v3/assignments
    get:
      summary: Get Single Assignment
      description: |
        Assignments are used to assign Account objects to analysts for investigation.
        This information includes but is not limited to:
          * Assigned to user
          * Assigned by user
          * Date assigned
          * Date resolved
          * Events
          * Outcome
          * Account ID
          * Triaged detections
      operationId: v3_assignments_read
      responses:
        '400':
          description: 'Invalid query parameter.'
          schema:
            $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3/assignments
    parameters:
      - $ref: "#/components/parameters/AssignmentsReadParamsV3/id"
    put:
      summary: Edit Assignment
      description: |
        Assignments are used to assign Account or Host objects to analysts for investigation.

        An API client can modify the user and/or account associated to an assignment using this endpoint.
      operationId: v3_assignments_update
      requestBody:
        $ref: '#/components/requestBodies/AssignmentPutBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: "Invalid input error."
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostAssignments'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3/assignments
  /api/v3/assignments/{id}/resolve/:
    parameters:
      - $ref: "#/components/parameters/AssignmentsReadParamsV3/id"
    put:
      summary: Resolve Assignment
      description: |
        Once completed, assignments can be resolved.
        Assignment resolutions provide a way to label and track
        the outcomes of assignments. Outcomes get recorded in the assignment's history.

        Outcome choices may include one of the following built-in
        assignment outcomes:
          * Benign True Positive
          * Malicious True Positive
          * False Positive

        Alternatively, users can choose to define their own Custom outcomes
        for reporting purposes.
      operationId: v3_assignments_resolve
      requestBody:
        $ref: '#/components/requestBodies/AssignmentsResolveBodyV3'
      responses:
        '409':
          description: 'Conflict error, assignment hsa already been resolved.'
          schema:
            $ref: '#/definitions/Error409ResolveAssignments'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: Invalid input error.
          schema:
            oneOf:
            - $ref: '#/definitions/Error400ResolveAssignmentsDetectionIDs'
            - $ref: '#/definitions/Error400ResolveAssignmentsOutcome'
            - $ref: '#/definitions/Error400ResolveAssignmentsTriageAs'
            - $ref: '#/definitions/Error400JsonParse'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              assignment:
                $ref: '#/definitions/Assignment'
      tags:
      - v3/assignments
  /api/v3/rules/:
    get:
      summary: Get Rule List
      tags:
      - v3/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint lists the existing Triage Rules in the system.
      operationId: v3_rules_list
      parameters:
        - $ref: '#/components/parameters/Common/ordering'
        - $ref: '#/components/parameters/Common/page'
        - $ref: '#/components/parameters/Common/page_size'
        - $ref: '#/components/parameters/RulesParamsV3/contains'
        - $ref: '#/components/parameters/RulesParamsV3/fields'
        - $ref: '#/components/parameters/RulesParamsV3/include_templates'
      responses:
        '404':
            description: The requested page does not exist. Reduce the requested page.
            schema:
              $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: null
              previous:
                format: uri
                type: string
                x-nullable: true
                example: null
              results:
                items:
                  $ref: '#/definitions/RuleSerializerV3'
                type: array
    post:
      summary: Create Rule
      tags:
      - v3/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This path's POST method supports two different creation tasks
        depending on the request body.

        **Task A**

        When specifying a new triage category in the request body
        without a detection list, this endpoint creates new Triage Rules.

        The following format is required for source_conditions
        and additional_conditions in the request body:

        The format for Triage rules is based on AND/OR logic,
        making them more flexible and customizable to your specific situation.
        Both 'source_conditions' and 'additional_conditions' are now
        saved as JSON blobs which represents a tree-like structure.
        Each tree node is represented in the following format:

        ```
        {operator: operand}
        ```

        Where "operator" is any of the following:

        ```
        For non-leaf nodes: 'AND' or 'OR'
        For leaf nodes: 'ANY_OF' or 'NONE_OF'
        ```

        The format for "operand" also depends on the type of node.

        For non-leaf nodes, use a list of children tree nodes of the form:

        ```
        [{operator: operand}, {operator: operand}, ...]
        ```

        For leaf nodes, use a dictionary of the form:

        ```
        {
          'field': <FIELD NAME>,
          'values': [{'value': [<VALUE>]}],
          'group': [{'value': [<GROUP ID>]}]
        }
        ```

        Stipulations on the format of the top-level tree structure
        is that the top-level operator must be an 'OR' node, with
        a single 'AND' node as the only child. The 'AND' node may have an arbitrary number
        of leaf node children. All valid Triage rules will look as follows:

        ```
        {
          'OR': [
            {
              'AND': [
                <LEAF NODE 1>,
                <LEAF NODE 2>,
                ...
                <LEAF NODE N>,
              ]
            }
          ]
        }
        ```

        Note 'source_conditions' and 'additional_conditions' have different fields
        that can be used in their leaf nodes. For 'source_conditions', the following
        fields are valid: ip, host, account, sensor. The fields 'ip' and 'host'
        also support triaging on groups, meaning that an IP or a host leaf node can
        be given an IP Group or Host Group ID, and the Triage rule will apply to
        every IP/host in the specified group. For 'additional_conditions', the following
        fields are valid: remote1_ip, remote1_proto, remote1_port, remote1_dns, remote2_ip,
        remote2_proto, remote2_port, remote2_dns, account, named_pipe, uuid,
        identity, share, extensions, rdp client name, rdp client token, keyboard name.
        The fields 'remote1_ip', 'remote2_ip', 'remote1_dns', 'remote2_dns' support
        triaging on groups. Either 'source_conditions' or 'additional_conditions' may
        be null. Setting source_conditions to null implies that this Triage rule with
        apply to All Hosts.

        **Task B**

        The POST Triage Rules endpoint can be used with a
        request body specifying detection ids and a triage category
        to filter a set of detections under the chosen triage category.
      operationId: v3_rules_create
      parameters:
      - in: body
        name: data
        required: true
        schema:
          oneOf:
          - title: Task A
            description: The schema for Task A.
            $ref: '#/definitions/RuleRequestBodyV3'
          - type: object
            title: Task B
            description: The schema for Task B.
            properties:
              detectionIdList:
                description: Detections ids to add to triage rule filter.
                items:
                  type: integer
                  example: 1
                type: array
              triage_category:
                type: string
                description: Custom Triage label used to categorize specified detections.
                example: Benign Detection
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400JsonParse'
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error422PostRulesInvalidField'
              - $ref: '#/definitions/Error422PostRulesConditionsField'
              - $ref: '#/definitions/Error422PostRulesDetectionList' 
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            oneOf:
            - type: object
              title: Task A
              description: The response for Task A.
              properties:
                id:
                  type: integer
                  description: Rule ID. 
                  example: 1
                _meta:
                  type: object
                  properties:
                    level:
                      type: string
                      description: Success status of operation. 
                      example: Success
                    message:
                      type: string
                      description: Message of success status of operation. 
                      example: "Successfully created triage filter"
            - type: object
              title: Task B
              description: The response for Task B.
              properties:
                ids:
                  type: array
                  items:
                    type: integer
                    example: 1
                  description: Rule IDs. 
                _meta:
                  type: object
                  properties:
                    level:
                      type: string
                      description: Success status of operation. 
                      example: Success
                    message:
                      type: string
                      description: Message of success status of operation. 
                      example: "Successfully created triage filter"
    delete:
      summary: Delete Detections Rule
      tags:
      - v3/rules
      description: |
        The DELETE Triage Rules endpoint can be used with the following
        request body to remove triage filters for a set of detections.
      operationId: v3_detection_rules_delete
      parameters:
      - in: body
        name: data
        required: true
        schema:
          type: object
          properties:
            detectionIdList:
              description: Detections ids to remove triage rule filters.
              items:
                type: integer
                example: 1
              type: array
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
        '422':
          description: Invalid input for detectionIdList.
          schema:
            $ref: '#/definitions/Error422DeleteRulesDetectionList'
  /api/v3/rules/{rule_id}/:
    parameters:
    - in: path
      name: rule_id
      required: true
      type: integer
      description: The rule ID. 
    put:
      summary: Edit Rule
      tags:
      - v3/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint manages updating Triage Rules.

        The following format is required for source_conditions
        and additional_conditions in the request body:

        The format for Triage rules is based on AND/OR logic,
        making them more flexible and customizable to your specific situation.
        Both 'source_conditions' and 'additional_conditions' are now
        saved as JSON blobs which represents a tree-like structure.
        Each tree node is represented in the following format:

        ```
        {operator: operand}
        ```

        Where "operator" is any of the following:

        ```
        For non-leaf nodes: 'AND' or 'OR'
        For leaf nodes: 'ANY_OF' or 'NONE_OF'
        ```

        The format for "operand" also depends on the type of node.

        For non-leaf nodes, use a list of children tree nodes of the form:

        ```
        [{operator: operand}, {operator: operand}, ...]
        ```

        For leaf nodes, use a dictionary of the form:

        ```
        {
          'field': <FIELD NAME>,
          'values': [{'value': [<VALUE>]}],
          'group': [{'value': [<GROUP ID>]}]
        }
        ```

        Stipulations on the format of the top-level tree structure
        is that the top-level operator must be an 'OR' node, with
        a single 'AND' node as the only child. The 'AND' node may have an arbitrary number
        of leaf node children. All valid Triage rules will look as follows:

        ```
        {
          'OR': [
            {
              'AND': [
                <LEAF NODE 1>,
                <LEAF NODE 2>,
                ...
                <LEAF NODE N>,
              ]
            }
          ]
        }
        ```

        Note 'source_conditions' and 'additional_conditions' have different fields
        that can be used in their leaf nodes. For 'source_conditions', the following
        fields are valid: ip, host, account, sensor. The fields 'ip' and 'host'
        also support triaging on groups, meaning that an IP or a host leaf node can
        be given an IP Group or Host Group ID, and the Triage rule will apply to
        every IP/host in the specified group. For 'additional_conditions', the following
        fields are valid: remote1_ip, remote1_proto, remote1_port, remote1_dns, remote2_ip,
        remote2_proto, remote2_port, remote2_dns, account, named_pipe, uuid,
        identity, share, extensions, rdp client name, rdp client token, keyboard name.
        The fields 'remote1_ip', 'remote2_ip', 'remote1_dns', 'remote2_dns' support
        triaging on groups. Either 'source_conditions' or 'additional_conditions' may
        be null. Setting source_conditions to null implies that this Triage rule with
        apply to All Hosts.
      operationId: v3_rule_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          $ref: '#/definitions/RuleRequestBodyV3'
      responses:
        '422':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error422PostRulesInvalidField'
              - $ref: '#/definitions/Error422PostRulesConditionsField'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Rules'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              data:
                $ref: '#/definitions/RuleSerializerV3'
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success status of operation. 
                    example: Success
                  message:
                    type: string
                    description: Message of success status of operation. 
                    example: "Successfully edited triage filter"
    delete:
      summary: Delete Rule
      tags:
      - v3/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint manages deleting rules from the system.
      operationId: v3_rule_delete
      parameters:
      - in: query
        name: restore_detections
        type: boolean
        required: false
        description: 'Select if detections filtered by this rule should be unfiltered.'
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: '' 
        '404':
          description: 'Not found error.'
        '400':
          description: Invalid query parameter requested.
          schema:
           $ref: '#/definitions/Error400InvalidParams'
    get:
      summary: Get Single Rule
      tags:
      - v3/rules
      description: |
        The Triage Rules API supports GET, POST, PUT, and DELETE.

        This endpoint lists a single Triage Rules in the system.
      operationId: v3_rule_read
      parameters:
      - description: Which field to use when ordering the results.
        in: query
        name: fields
        required: false
        type: string
        enum:
        - id
        - url
        - description
        - enabled
        - created_timestamp
        - last_timestamp
        - is_whitelist
        - priority
        - active_detections
        - total detections
        - template
        - additional_conditions
        - source_condition
        - detection
        - detection_category
        - triage_category
      responses:
        '400':
          description: Invalid query parameter requested.
          schema:
           $ref: '#/definitions/Error400InvalidParams'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/RuleSerializerV3'
  /api/v3/detections/:
    get:
      summary: Get Detection List
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Detections are grouped into one of the following categories:
        | Detection Category  | URL |
        | -------- | ------- |
        | Command & Control  | /detections?detection_category=command    |
        | Botnet | /detections?detection_category=botnet     |
        | Reconnaissance    | /detections?detection_category=reconnaissance    |
        | Lateral Movement    | /detections?detection_category=lateral    |
        | Exfiltration    | /detections?detection_category=exfiltration    |
        | Info    | /detections?detection_category=info    |

        Please note that AWS imposes a 30 second timeout window for all requests. As a result, this endpoint may timeout when trying to query large amounts of complex detection data. If experiencing 504 responses, please try to adjust the number of detections returned by using the 'page_size' query parameter.

        The API query performs partial word match. For example, you can use /detections?
        detection_category=recon to query all Reconnaissance category detections.

      operationId: v3_detections_list
      parameters:
      - $ref: '#/components/parameters/DetectionsParamsV3/ordering'
      - $ref: '#/components/parameters/DetectionsParamsV3/page'
      - $ref: '#/components/parameters/DetectionsParamsV3/page_size'
      - $ref: '#/components/parameters/DetectionsParamsV3/category'
      - $ref: '#/components/parameters/DetectionsParamsV3/certainty'
      - $ref: '#/components/parameters/DetectionsParamsV3/certainty_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/c_score'
      - $ref: '#/components/parameters/DetectionsParamsV3/c_score_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/description'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection_type'
      - $ref: '#/components/parameters/DetectionsParamsV3/detection_category'
      - $ref: '#/components/parameters/DetectionsParamsV3/exclude_fields'
      - $ref: '#/components/parameters/DetectionsParamsV3/fields'
      - $ref: '#/components/parameters/DetectionsParamsV3/host_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/host_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/id'
      - $ref: '#/components/parameters/DetectionsParamsV3/is_targeting_key_asset'
      - $ref: '#/components/parameters/DetectionsParamsV3/is_triaged'
      - $ref: '#/components/parameters/DetectionsParamsV3/last_timestamp'
      - $ref: '#/components/parameters/DetectionsParamsV3/last_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/min_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/max_id'
      - $ref: '#/components/parameters/DetectionsParamsV3/note_modified_timestamp_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/src_account'
      - $ref: '#/components/parameters/DetectionsParamsV3/src_account'
      - $ref: '#/components/parameters/DetectionsParamsV3/src_ip'
      - $ref: '#/components/parameters/DetectionsParamsV3/state'
      - $ref: '#/components/parameters/DetectionsParamsV3/tags'
      - $ref: '#/components/parameters/DetectionsParamsV3/targets_key_asset'
      - $ref: '#/components/parameters/DetectionsParamsV3/threat'
      - $ref: '#/components/parameters/DetectionsParamsV3/threat_gte'
      - $ref: '#/components/parameters/DetectionsParamsV3/t_score'
      - $ref: '#/components/parameters/DetectionsParamsV3/t_score_gte'
      responses:
        '404':
          description: The requested page does not exist. Reduce the requested page.
          schema:
            $ref: '#/definitions/Error404InvalidPage'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              count:
                type: integer
                example: 1
              next:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3/detections?page=3&page_size=1
              previous:
                format: uri
                type: string
                x-nullable: true
                example: https://VECTRA_PORTAL_URL/api/v3/detections?page=1&page_size=1
              results:
                items:
                  $ref: '#/definitions/DetectionSerializerV3'
                type: array
            required:
            - count
            - results
            type: object
      tags:
      - v3/detections
    parameters: []
    patch:
      summary: Mark Detections as Fixed
      description: |
        Marking a detection as Fixed indicates that some remedial action
        was taken based upon the detection.
        Threat and Certainty scores will both be 0 once a detection has been marked as fixed.
      operationId: v3_detections_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            detectionIdList:
              items:
                type: integer
                example: 1
              type: array
            mark_as_fixed:
              type: boolean
              example: true 
          required:
          - detectionIdList
          - mark_as_fixed
          type: object
      responses:
        '404':
          description: Not found error.
          schema:
            $ref: '#/definitions/Error404PatchDetections'
        '422':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error422PatchDetections'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            properties:
              _meta:
                type: object
                properties:
                  level:
                    type: string
                    description: Success flag for patch.
                    example: Success
                  message:
                    type: string
                    description: Operation message.
                    example: "Successfully marked detections"
      tags:
      - v3/detections
  /api/v3/detections/{id}/:
    get:
      summary: Get Single Detection
      description: |
        Detection objects contain all the information related to security
        events detected in the environment.

        Detections are grouped into one of the following categories:
        | Detection Category  | URL |
        | -------- | ------- |
        | Command & Control  | /detections?detection_category=command    |
        | Botnet | /detections?detection_category=botnet     |
        | Reconnaissance    | /detections?detection_category=reconnaissance    |
        | Lateral Movement    | /detections?detection_category=lateral    |
        | Exfiltration    | /detections?detection_category=exfiltration    |
        | Info    | /detections?detection_category=info    |

      operationId: v3_detections_read
      parameters:
      - description: Fields to include in the response object.
        enum:
        - id
        - url
        - detection_url
        - category
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - t_score
        - c_score
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - targets_key_asset
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        - campaign_summaries
        - grouped_details
        - summary
        - is_triaged
        - src_linked_account
        in: query
        name: fields
        required: false
        type: string
      - description: Fields to exclude in the response object.
        enum:
        - id
        - url
        - detection_url
        - category
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - t_score
        - c_score
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - targets_key_asset
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        in: query
        name: exclude_fields
        required: false
        type: string
      responses:
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '400':
          description: 'Invalid query parameter or parameter value.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400InvalidParams'
              - $ref: '#/definitions/Error400InvalidParamValue'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/DetectionSerializerV3'
      tags:
      - v3/detections
    parameters:
    - in: path
      name: id
      required: true
      type: integer
    patch:
      summary: Edit Single Detection
      description: |
        Detection objects contain all the information related to security events detected in the environment.

        Marking a detection as Fixed indicates that some remedial action was taken based upon the detection.
        Threat and Certainty scores will both be 0 once a detection has been marked as fixed.
      operationId: v3_detection_partial_update
      parameters:
      - in: body
        name: data
        required: true
        schema:
          properties:
            mark_as_fixed:
              type: boolean
              example: true 
            note:
              type: string
              example: Example note
            note_id:
              type: integer
              example: 1
            triageAs:
              type: string
              example: Benign Detection
          type: object
      responses:
        '422':
          description: Returned when request body is missing.
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Generic'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error. May be returned if the user is not allowed to edit notes created by other users.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: 'Returned when a triage filter has been created for the detection.'
        '200':
          description: 'Returned when a detection has been marked as fixed or a detection note has been updated.'
      tags:
      - v3/detections
  /api/v3/events/account_detection/:
    get:
      summary: Get Account Detection Events
      description: |
        Account Detection Events are generated upon initial detection and for each
        update of the detection.

        Example URL to retrieve account detection events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3/events/account_detection?from=101`.
      operationId: v3_events_account_detection_list
      parameters:
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/account_uid'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/detection_id'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/from'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/include_info_category'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/include_triaged'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/ordering'
        - $ref: '#/components/parameters/EventsAccountDetectionsListParamsV3/since'
      responses:
        '400':
          description: 'Invalid input error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                $ref: '#/definitions/DetectionEventSerializerV3'
      tags:
      - v3/events
    parameters: []
  /api/v3/events/account_scoring/:
    get:
      summary: Get Account Scoring Events
      description: |
        Account Scoring Events are generated when an account score is changed, which occurs upon initial
        threat detection, discovery of additional detections, and updates to any discovered detections. The
        account score is reduced over time if the underlying detection behavior subsides, either because of user
        intervention or because the account has left the environment.

        Example URL to retrieve account scoring events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3/events/account_scoring?from=101`.
      operationId: v3_events_account_scoring_list
      parameters:
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/account_uid'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/from'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/since'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/include_score_decreases'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAccountScoringListParamsV3/ordering'
      responses:
        '400':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/AccountScoringEventSerializerV3'
      tags:
      - v3/events
    parameters: []
  /api/v3/events/audits/:
    get:
      summary: Get Audit Log Events
      description: |
        Audit Log Events are generated when a user action is performed on the system. Audit Log Event are
        sequential and can be used to create an audit trail of user activity on your system.

        > NOTE: Audit events are persisted for 1 year.

        Example URL to retrieve audit events from the last checkpoint is
        `https://VECTRA_PORTAL_URL/api/v3/events/audits?from=101`.
      operationId: v3_events_audits_list
      parameters:
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_timestamp_gte'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_timestamp_lte'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/from'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/user_id'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_object'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/event_action'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/limit'
        - $ref: '#/components/parameters/EventsAuditsListParamsV3/ordering'
      responses:
        '400':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error400EventInvalidParam'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              next_checkpoint:
                example: 2
                type: integer
                description:
                  The next event id checkpoint for remaining events to query
                  (if any exist).
              remaining_count:
                type: integer
                example: 0
                description:
                  The number of events remaining to query. This excludes
                  events filtered out by query params.
              events:
                type: array
                items:
                  $ref: '#/definitions/AuditEventSerializerV3'
      tags:
      - v3/events
    parameters: []
  /api/v3/tagging/{table}/:
    delete:
      summary: Bulk Delete Tag
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to delete a tag for a list of entities.
      operationId: v3_tagging_delete
      requestBody:
        $ref: '#/components/requestBodies/BulkTaggingBodyV3'
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400BulkInvalidTag'
        '404':
          description: Not found error.
          schema:
              $ref: '#/definitions/Error404BulkPatchTags'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
      tags:
      - v3/tagging
    parameters:
       - $ref: "#/components/parameters/TaggingParamsV3/table"
    post:
      summary: Bulk Create Tag
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to create a tag for a list of entities.
      operationId: v3_tagging_create
      requestBody:
        $ref: '#/components/requestBodies/BulkTaggingBodyV3'
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            type: object
            properties:
              status:
                type: string
                example: success
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400BulkInvalidTag'
              - $ref: '#/definitions/Error400JsonParse'
        '404':
          description: Not found error.
          schema:
              $ref: '#/definitions/Error404BulkPatchTags'
      tags:
      - v3/tagging
  /api/v3/tagging/{table}/{entity_id}/:
    get:
      summary: Get Entity Tag List
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to list tags for a single entity.
      operationId: v3_tagging_read
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Tags'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TaggingSerializerV3'
      tags:
      - v3/tagging
    parameters:
      - $ref: "#/components/parameters/TaggingParamsV3/table"
      - $ref: "#/components/parameters/TaggingParamsV3/entity_id"
    patch:
      summary: Edit Entity Tag
      description: |
        The tagging API can be used to manage tags for accounts and detections.

        An API client can use this endpoint to replace all tags for an entity with a list of tags.
      operationId: v3_tagging_partial_update
      requestBody:
        $ref: '#/components/requestBodies/TaggingBodyV3'
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '400':
          description: Invalid input error.
          schema:
            oneOf:
              - $ref: '#/definitions/Error400PatchTagsMissingTags'
              - $ref: '#/definitions/Error400PatchTagsInvalidTagType'
              - $ref: '#/definitions/Error400PatchTagsInvalidTag'
              - $ref: '#/definitions/Error400JsonParse'
        '404':
          description: 'Not found error.'
          schema:
            $ref: '#/definitions/Error404Tags'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TaggingSerializerV3'
      tags:
      - v3/tagging
  /api/v3/{tvui_types}/{type_id}/notes/:
    get:
      summary: Get Entity Note List
      description: |
        An API client can list all of the Note objects associated with a single entity using this endpoint.
      operationId: v3_notes_list
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            items:
              $ref: '#/definitions/NoteSerializerV2_2'
            type: array
      tags:
      - v3/notes
    parameters:
      - $ref: '#/components/parameters/NotesParamsV3/tvui_types'
      - $ref: '#/components/parameters/NotesParamsV3/type_id'
    post:
      summary: Create Entity Note
      description: |
        An API client can use this endpoint to create a note for an entity.
      operationId: v3_notes_create
      requestBody:
        $ref: '#/components/requestBodies/NotesBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '400':
          description: 'Invalid input error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostNotes'
            - $ref: '#/definitions/Error400JsonParse'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '201':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3/notes
  /api/v3/{tvui_types}/{type_id}/notes/{note_id}/:
    delete:
      summary: Delete Entity Note
      description: |
        An API client can use this endpoint to delete a note for an entity.
      operationId: v3_notes_delete
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '204':
          description: ''
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
      tags:
      - v3/notes
    get:
      summary: Get Entity Single Note
      description: |
        An API client can use this endpoint to view a note for an entity.
      operationId: v3_notes_read
      responses:
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
              - $ref: '#/definitions/Error404Generic'
              - $ref: '#/definitions/Error404URLNotFound'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3/notes
    parameters:
      - $ref: '#/components/parameters/NotesParamsV3/tvui_types'
      - $ref: '#/components/parameters/NotesParamsV3/type_id'
      - $ref: '#/components/parameters/NotesParamsV3/note_id'
    patch:
      summary: Edit Entity Note
      description: |
        An API client can use this endpoint to modify a note for an entity.
      operationId: v3_notes_partial_update
      requestBody:
        $ref: '#/components/requestBodies/NotesBodyV3'
      responses:
        '404':
          description: 'Not found error.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error404Generic'
            - $ref: '#/definitions/Error404URLNotFound'
        '400':
          description: 'Invalid input error for note.'
          schema:
            oneOf:
            - $ref: '#/definitions/Error400PostNotes'
            - $ref: '#/definitions/Error400JsonParse'
        '422':
          description: 'Invalid input error. Missing note param.'
          schema:
            $ref: '#/definitions/Error422PatchNoteMissingNote'
        '401':
          description: 'Authentication error.'
          schema:
            $ref: '#/definitions/Error401'
        '403':
          description: 'Authorization error.'
          schema:
            $ref: '#/definitions/Error403'
        '413':
          description: 'Response too large error.'
          schema:
            $ref: '#/definitions/Error413'
        '429':
          description: 'Too many requests error.'
          schema:
            $ref: '#/definitions/Error429'
        '500':
          description: 'Unexpected error.'
          schema:
            $ref: '#/definitions/Error500'
        '503':
          description: 'Service unavailable error.'
          schema:
            $ref: '#/definitions/Error503'
        '504':
          description: 'Time out error.'
          schema:
            $ref: '#/definitions/Error504'
        '200':
          description: ''
          schema:
            $ref: '#/definitions/NoteSerializerV2_2'
      tags:
      - v3/notes
definitions:
  HealthCheckEvent:
    type: object
    properties:
      event_object:
        type: object
        properties:
          type:
            type: string
            description: Type of the monitored Entity
            example: "device"
          name:
            type: string
            description: Name of the monitored Entity
            example: "saas123124"
        required:
          - type
          - name
        title: Entity Information
        description: Information about the entity this health event relates to
      health_check_name:
        type: string
        title: Health Check Name
        description: Name of the health check that triggered the event
        example: "cpu_check"
      status:
        type: object
        properties:
          code:
            type: integer
            description: "0=OK, 1=WARNING, 2=CRITICAL, 3=SKIP, 4=UNKNOWN, 5=TIMEOUT, 6=INFO, 11=ERROR"
            example: 0
          label:
            type: string
            description: String representation of the status code
            example: "OK"
        required:
          - code
          - label
        title: Status Code
        description: Event Status Code
      output:
        type: string
        title: Output
        description: |
          Raw health check output - probably JSON format but not necessarily following a consistent schema.
        example: '{"cpu_usage": 45.2}'
      event_timestamp:
        type: string
        format: date-time
        title: Event Time
        description: Time that the health check was executed
        example: "2024-01-15T10:30:00Z"
      last_state_change_at:
        type: string
        format: date-time
        title: Last State Change
        description: Time that the health check last changed state
        example: "2024-01-15T09:30:00Z"
      last_state:
        type: string
        title: Last State
        description: Last state of the health check
        example: "OK"
      last_ok_at:
        type: string
        format: date-time
        title: Last OK
        description: Time that the health check was last OK
        example: "2024-01-15T10:00:00Z"
    required:
      - event_object
      - health_check_name
      - status
      - output
      - event_timestamp
      - last_state_change_at
      - last_state
      - last_ok_at

  AccountLDAP:
    type: object
    properties:
      ldap:
        description: Information about the LDAP server the account came from (if applicable).
        type: object
        example:
          title:
          - Software Engineer
          account_disabled: false 
          common_name: John Doe
  AccountHostAccessHistory:
    type: object
    properties:
      host_access_history:
        description: Information about the host access history of the account (if applicable).
        type: array
        items:
          type: object
          properties:
            id:
              type: integer
              example: 1
            name:
              type: string
              example: "fc-iappvec-09"
            privilege:
              type: integer
              example: 1
            privilege_category:
              type: string
              example: Low
            last_seen:
              type: string
              format: date-time
              example: "2025-03-06T16:00:00Z"
  DetectionSummary:
    type: object
    properties:
      detection_id: 
        type: integer
        example: 1
      detection_url: 
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/api/v3/detections/1"
      detection_type: 
        type: string
        example: AWS Suspect External Access Granting
      detection_category: 
        type: string
        example: EXFILTRATION
      is_targeting_key_asset: 
        type: boolean
        example: false
      state: 
        type: string
        example: active
      threat: 
        type: integer
        example: 90
      certainty: 
        type: integer
        example: 10
      is_triaged: 
        type: boolean
        example: false
      tags: 
        type: array
        items: 
          type: string
          example: Example tag
      summary: 
        type: object
        example: 
          event_names:
          - UpdateAssumeRolePolicy
          num_events: 5
          src_external_hosts:
            - ip: 100.100.100.100
              name: null
          identity_type: "AWS External Account"
          assumed_roles:
          - developers
          user_agents:
          - "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)"
          aws_account_ids: 123456789012
          aws_regions: us-east-1
          description: "AWS control plane APIs enabled external access to AWS resources through an IAM role."
      assigned_to: 
        type: string
        example: "email@domain.com"
      assigned_date: 
        type: string
        format: date-time
        example: "2025-03-05T21:53:01Z"
  DataSource:
    type: object
    properties:
      type:
        type: string
        enum:
        - aws
        - o365
        - azure-cp
        - defender
        - crowdstrike
        - sentinelone
        - network
        example:
        - o365
      connection_name:
        type: string
        example: ingest-prod-trail
      connection_id:
        type: string
        example: "k13bdhz0"
  UniqueHostObservedSerializerV3_4:
    type: object
    properties:
      start_date:
        type: string
        format: date-time
        description: First day of given timespan.
        example: "2025-01-19"
      end_date:
        type: string
        format: date-time
        description: Last day of given timespan.
        example: "2025-03-19"
      unique_hosts_observed:
        type: integer
        description:  Count of unique hosts observed between start_date and
          end_date.
        example: 330
        minimum: 0
  AccountSerializerV3:
    properties:
      account_type:
        description: The method through which this account was discovered. Can be
          one or more of the listed options.
        type: array
        items:
          example: o365
          type: string
          enum:
          - entra_principal
          - o365
          - aws
          - kerberos
      assignment:
        description: Information about the assignment associated with the account.
        $ref: "#/definitions/Assignment"
      certainty:
        description: The certainty score attributed to the account. 
        type: integer
        example: 20
        minimum: 0
        maximum: 100
      data_source:
        description: Information about the data source. Includes type, connection
          name, and connection ID.
        $ref: "#/definitions/DataSource"
      detection_set:
        description: List of detections for account. 
        items:
          format: uri
          type: string
          example: "https://exampleurl.vectra.ai/api/v3/detections/1"
        type: array
      detection_summaries:
        description: List of detection summaries for the account. 
        items:
          $ref: '#/definitions/DetectionSummary'
        type: array
      id:
        description: The ID of the account.
        type: integer
        example: 1
        minimum: 1
      last_detection_timestamp:
        description: Timestamp of the last detection activity from this account.
        type: string
        example: '2025-03-03T10:46:38Z'
      name:
        description: The name associated with the account.
        type: string
        example: "O365:email@domain.com"
      note:
        description: User-defined note added to the account.
        type: string
        example: 'Example note.'
      note_modified_by:
        description: Username who last modified the note.
        type: string
        example: "email@domain.com"
      note_modified_timestamp:
        description: Timestamp when the note was last modified.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      notes:
        description: An array of all notes on the account. Includes id, date_created,
          date_modified, created_by, modified_by, and note contents. 
          objects
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      past_assignments:
        description: List of past assignments associated with the account.
        type: array
        items:
          $ref: "#/definitions/Assignment"
      privilege_category:
        description: A string to represent how privileged this account is. Either
          'Low', 'Medium', or 'High'.
        type: string
        enum:
        - Low
        - Medium
        - High
        example: Low
      privilege_level:
        description: A number 1-10 to represent how privileged this account is.
        type: integer
        example: 2
        minimum: 1
        maximum: 10
      probable_home:
        description: Name of the probable home of the account. 
        type: string
        example: ad.example.com
      sensors:
        description: List of sensors associated with the account. 
        type: array
        items:
          type: string
          example: lq6fk8hc
      severity:
        description: The severity of this account. Either 'Low', 'Medium', 'High',
          or 'Critical'. Calculated based on the threat and certainty of the account.
        type: string
        enum:
        - Low
        - Medium
        - High
        - Critical
        example: Low
      state:
        description: The state of the account.
        type: string
        enum:
        - active
        - inactive
        example: active
      tags:
        description: User-defined tags added to the account. 
        type: array
        items:
          type: string
          example: example tag
      threat:
        description: The threat score attributed to the account. 
        type: integer
        example: 3
        minimum: 0
        maximum: 100
      url:
        description: A v3.0 URL to the account. Useful when using a web-based REST
          API browser. 
        format: url
        type: string
        example: "https://exampleurl.vectra.ai/api/v3.x/accounts/1"
    type: object
  AccountSerializerV3_2:
    properties:
      account_type:
        description: The method through which this account was discovered. Can be
          one or more of the listed options.
        type: array
        items:
          example: o365
          type: string
          enum:
          - entra_principal
          - o365
          - aws
          - kerberos
      assignment:
        description: Information about the assignment associated with the account.
        $ref: "#/definitions/Assignment"
      certainty:
        description: The certainty score attributed to the account. 
        type: integer
        example: 20
        minimum: 0
        maximum: 100
      data_source:
        description: Information about the data source. Includes type, connection
          name, and connection ID.
        $ref: "#/definitions/DataSource"
      detection_set:
        description: List of detections for account. 
        items:
          format: uri
          type: string
          example: "https://exampleurl.vectra.ai/api/v3/detections/1"
        type: array
      detection_summaries:
        description: List of detection summaries for the account. This is only included when 
          the param include_detection_summaries is set to true.
        items:
          $ref: '#/definitions/DetectionSummary'
        type: array
      id:
        description: The ID of the account.
        type: integer
        example: 1
        minimum: 1
      last_detection_timestamp:
        description: Timestamp of the last detection activity from this account.
        type: string
        example: '2025-03-03T10:46:38Z'
      name:
        description: The name associated with the account.
        type: string
        example: "O365:email@domain.com"
      note:
        description: User-defined note added to the account.
        type: string
        example: 'Example note.'
      note_modified_by:
        description: Username who last modified the note.
        type: string
        example: "email@domain.com"
      note_modified_timestamp:
        description: Timestamp when the note was last modified.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      notes:
        description: An array of all notes on the account. Includes id, date_created,
          date_modified, created_by, modified_by, and note contents. 
          objects
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      past_assignments:
        description: List of past assignments associated with the account.
        type: array
        items:
          $ref: "#/definitions/Assignment"
      privilege_category:
        description: A string to represent how privileged this account is. Either
          'Low', 'Medium', or 'High'.
        type: string
        enum:
        - Low
        - Medium
        - High
        example: Low
      privilege_level:
        description: A number 1-10 to represent how privileged this account is.
        type: integer
        example: 2
        minimum: 1
        maximum: 10
      probable_home:
        description: Name of the probable home of the account. 
        type: string
        example: ad.example.com
      sensors:
        description: List of sensors associated with the account. 
        type: array
        items:
          type: string
          example: lq6fk8hc
      severity:
        description: The severity of this account. Either 'Low', 'Medium', 'High',
          or 'Critical'. Calculated based on the threat and certainty of the account.
        type: string
        enum:
        - Low
        - Medium
        - High
        - Critical
        example: Low
      state:
        description: The state of the account.
        type: string
        enum:
        - active
        - inactive
        example: active
      subaccounts:
        description: |
          A list of associated accounts. To be deprectaed in future versions in
          favor for associated_accounts.
        type: array
        items:
          type: string
          example: "O365:email@domain.com"
      tags:
        description: User-defined tags added to the account. 
        type: array
        items:
          type: string
          example: example tag
      threat:
        description: The threat score attributed to the account. 
        type: integer
        example: 3
        minimum: 0
        maximum: 100
      url:
        description: A v3.0 URL to the account. Useful when using a web-based REST
          API browser. 
        format: url
        type: string
        example: "https://exampleurl.vectra.ai/api/v3.2/accounts/1"
    type: object
  AccountScoringEventSerializerV3:
    type: object
    properties:
      account_id:
        description: Account ID.
        type: integer
        example: 1
      account_uid:
        description: Account UID.
        type: string
        example: "O365:email@domain.com"
      active_detection_type:
        description: A list of active detection types.
        type: array
        items:
          type: string
          example: "Azure AD Admin Account Creation"
      assignment:
        description: Information about the assignment associated with the account.
        $ref: "#/definitions/Assignment"
      category:
        description: Event category.
        type: string
        example: "ACCOUNT SCORING"
      certainty:
        description: The certainty score attributed to the
          account.
        type: integer
        example: 10
      event_timestamp:
        description: Timestamp when the detection event occurred. Timestamp format-
          YYYY-MM-DD HH:MM-SS GMT.
        type: string
        format: date-time
      href:
        description: URL link to see the account in the UI.
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/accounts/1"
      id:
        description: Unique identifier for the event.
        type: integer
        example: 1
      last_detection_href:
        description: URL link of the last detection.
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/detections/1"
      last_detection_id:
        description: Id of the last detection.
        type: integer
        example: 1
      last_detection_type:
        description: The type of the last detection.
        type: string
        example: "Azure AD Admin Account Creation"
      score_decrease:
        description: Indicates whether both Threat and
          Certainty scores are decreasing.
        type: boolean
      severity:
        description: The severity attributed to the
          account.
        type: integer
        example: 5
      threat:
        description: The threat score attributed to the
          account.
        type: integer
        example: 5
      tags:
        description: Tags associated with the event
        type: array
        items:
          type: string
          example: Example tag
      version:
        description: The Vectra UI version during the event.
        type: string
        example: "202502.11.0"
  AssignmentSummary:
    properties:
      assigned_by:
        description: The user that made the assignment. 
        properties:
          id:
            type: integer
            example: 1
          username:
            type: string
            example: "email@domain.com"
        type: object
      assigned_to:
        description: The user assigned to the assignment. 
        properties:
          id:
            type: integer
            example: 1
          username:
            type: string
            example: "email@domain.com"
        type: object
      date_assigned:
        description: The time when the assignment was assigned. 
        format: date-time
        type: string
        example: '2025-01-08T18:07:35.127977+00:00'
      id:
        description: The assignment id. 
        type: integer
        example: 1
    type: object
  Assignment:
    properties:
      account_id:
        description: The id of the account associated with the assignment. 
        type: integer
        example: 1
        x-nullable: true
      assigned_by:
        description: The user that made the assignment. 
        properties:
          id:
            type: integer
            example: 1
          username:
            type: string
            example: "email@domain.com"
        type: object
      assigned_to:
        description: The user assigned to the assignment. 
        properties:
          id:
            type: integer
            example: 1
          username:
            type: string
            example: "email@domain.com"
        type: object
      date_assigned:
        description: The time when the assignment was assigned. 
        format: date-time
        type: string
        example: '2025-01-08T18:07:35.127977+00:00'
      date_resolved:
        description: The time when the assignment was resolved. 
        format: date-time
        type: string
        x-nullable: true
        example: null
      events:
        description: Actions taken on the assignment. 
        type: array
        items:
          $ref: '#/definitions/AssignmentEvent'
      host_id:
        description: The id of the host associated with the assignment. 
        type: integer
        example: null
        x-nullable: true
      id:
        description: The assignment id. 
        type: integer
        example: 1
      outcome:
        $ref: '#/definitions/AssignmentOutcome'
      resolved_by:
        description: The user that resolved the assignment. 
        properties:
          id:
            type: integer
            example: 1
          username:
            type: string
            example: "email@domain.com"
        type: object
      triaged_detections:
        description: The detection ids that were triaged as a part of the resolution
          of the assignment. 
        type: array
        items:
          type: integer
          example: 2
    type: object
  AssignmentEvent:
    properties:
      actor:
        type: integer
        example: 2
      assignment_id:
        type: integer
        example: 1
      context:
        type: object
        properties:
          to:
            type: integer
            example: 61
          entity_t_score:
            type: integer
            example: 88
          entity_c_score:
            type: integer
            example: 10
          triage_as:
            type: string
            x-nullable: true
            example: null
          triage_detection_ids:
            type: array
            items:
              type: integer
            example: []
          fixed_detection_ids:
            type: array
            items:
              type: integer
            example: []
      datetime:
        format: date-time
        type: string
      event_type:
        enum:
        - migration_closed
        - migration_created
        - host_merge_closed
        - created
        - reassigned
        - resolved
        - deleted
        type: string
        example: created
    type: object
  AssignmentOutcome:
    properties:
      builtin:
        description: Whether the outcome is a Vectra builtin outcome. 
        type: boolean
        example: false
      category:
        description: The outcome category. 
        enum:
        - benign_true_positive
        - malicious_true_positive
        - false_positive
        - internal
        type: string
        example: benign_true_positive
      id:
        description: The outcome id. 
        type: integer
        example: 1
      title:
        description: The title of the outcome. 
        type: string
        example: "Benign True Positive"
      user_selectable:
        description: Whether the outcome can be selected by GUI users. 
        type: boolean
        example: false
    type: object
  AuditEventSerializerV3:
    type: object
    properties:
      api_client_id:
        description: API client ID, if an event was caused by an
          API client interaction.
        type: string
        example: "b24d73819eed55528efee804f2024371"
      event_action:
        description: The event action being audited.
        type: string
        example: updated
      event_object:
        description: The object type the audited action is being performed on.
        type: string
        example: filter
      event_data:
        description: JSON data specific to the event type.
        type: object
        example:
          filter:
            id: 1
            vname: "External Remote Access"
            changes:
              removed: []
              added: []
      event_timestamp:
        description: The event timestamp.
        type: string
        format: date-time
        example: "2019-08-27T20:55:29Z"
      id:
        description: The event idle.
        type: integer
        example: 1
      message:
        description: Message describing the event.
        type: string
        example: 'edit triage filter "Expected M365 Behavior" - id 1 External Remote Access - no fields changed'
      result_status:
        description: Success or failure describing the event.
        type: string
        example: success
      user_role:
        description: Role the user/API client had at the time of the
          event.
        type: string
        example: "Security Analyst"
      source_ip:
        description: IP address of the user/API client.
        type: string
        format: ipv4
      user_id:
        description: User ID of the user account associated with
          the event.
        type: integer
        example: 1
      user_type:
        description: User type, e.g. "LOCAL", "SAML",
          "API_CLIENT"
        type: string
        example: API_CLIENT
      username:
        description: Username of the account associated with the
          event, at the time of the event.
        type: string
        example: api_client_b24d73819eed55528efee804f2024371
      version:
        description: Vectra UI version at the time of the event.
        type: string
        example: "202502.11.0"
  DetectionEventSerializerV3:
    properties:
      account_href:
        description: URL link to view the account details in the UI.
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/accounts/1"
      account_id:
        description: The ID of the Account.
        type: string
        example: 1
      account_uid:
        description: The account UID.
        type: string
        example: "O365:email@domain.com"
      category:
        description: The detection category.
        type: string
        example: lateral_movement
      certainty:
        description: The certainty score attributed to the detection.
        type: integer
        example: 10
      d_type_vname:
        description: The detection name.
        type: string
        example: "Brute-Force"
      detail:
        description: The detection detail. Detail fields are specific to the detection
          type. 
        type: object
        example:
          num_attempts: 2
          app_protocol: ssh
          dst_ips: 100.100.100.100
          target_domains: "targetdomain.tvec"
          first_timestamp: "2024-08-26T05:33:30Z"
          last_timestamp: "2024-08-27T05:33:30Z"
          dst_hosts:
            id: 2
            name: U02012340000939
            ip: 100.100.100.100
      detection_href:
        description: URL link to see the detection in the UI.
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/detections/1"
      detection_id:
        description: The ID of the detection.
        type: integer
        example: 1
      detection_type:
        description: The detection type.
        type: string
        example: Brute-Force
      entity_name:
        description: The human-readable account name.
        type: string
        example: Admin Prod
      event_timestamp:
        description: Timestamp when the Account Detection Event occurred.
        format: date-time
        type: string
      href:
        description: URL link to see the account in the UI.
        type: string
        example: "https://exampleurl.vectra.ai/accounts/1"
      id:
        description: The ID of the Account Detection Event.
        type: integer
        example: 1
      ip:
        description: The IP address.
        type: string
        format: ipv4
        example: 100.100.100.100
      severity:
        description: The severity of the detection.
        type: integer
        example: 6
      src_account:
        description: The source account.
        type: string
        example: "O365:email@domain.com"
      threat:
        description: The threat score attributed to the detection.
        type: integer
        example: 62
      triaged:
        description: Indicates whether the detection has been triaged.
        type: boolean
        example: false
    type: object
  DetectionEventSerializerV3_3:
    properties:
      category:
        description: The detection category.
        type: string
        example: lateral_movement
      certainty:
        description: The certainty score attributed to the detection.
        type: integer
        example: 10
      d_type_vname:
        description: The detection name.
        type: string
        example: "Brute-Force"
      detail:
        description: The detection detail. Detail fields are specific to the detection
          type.
        type: object
        example:
          num_attempts: 2
          app_protocol: ssh
          dst_ips: 100.100.100.100
          target_domains: "targetdomain.tvec"
          first_timestamp: "2024-08-26T05:33:30Z"
          last_timestamp: "2024-08-27T05:33:30Z"
          dst_hosts:
            id: 2
            name: U02012340000939
            ip: 100.100.100.100
      detection_href:
        description: URL link to see the detection in the UI.
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/detections/1"
      detection_id:
        description: The ID of the detection.
        type: integer
        example: 1
      detection_type:
        description: The detection type.
        type: string
        example: Brute-Force
      entity_id:
        description: The ID of the entity.
        type: integer
        example: 1
      entity_name:
        description: The human-readable account or host name.
        type: string
        example: Admin Prod
      entity_type:
        description: The type of the entity.
        enum:
        - account
        - host
        type: string
        example: account
      entity_uid:
        description: The UID of the entity.
        type: string
        example: "O365:email@domain.com"
      event_timestamp:
        description: Timestamp when the Entity Detection Event occurred.
        format: date-time
        type: string
      id:
        description: The ID of the Entity Detection Event.
        type: integer
        example: 1
      mitre:
        description: The mitre associted with the Detection Event.
        type: array
        items:
          type: string
          example: T1110
      severity:
        description: The severity of the detection.
        type: integer
        example: 5
      threat:
        description: The threat score attributed to the detection.
        type: integer
        example: 10
      triaged:
        description: Indicates whether the detection has been triaged.
        type: boolean
        example: false
      type:
        description: The type of the related entity for the event.
        type: string
        enum:
        - host
        - account
        example: account
      url:
        description: The URL associated with the detection entity.
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/accounts/1"
    type: object
  DetectionEventSerializerV3_4:
    properties:
      category:
        description: The detection category.
        type: string
        example: lateral_movement
      certainty:
        description: The certainty score attributed to the detection.
        type: integer
        example: 10
      d_type_vname:
        description: The detection name.
        type: string
        example: "Brute-Force"
      detail:
        description: The detection detail. Detail fields are specific to the detection
          type.
        type: object
        example:
          num_attempts: 2
          app_protocol: ssh
          dst_ips: 100.100.100.100
          target_domains: "targetdomain.tvec"
          first_timestamp: "2024-08-26T05:33:30Z"
          last_timestamp: "2024-08-27T05:33:30Z"
          dst_hosts:
            id: 2
            name: U02012340000939
            ip: 100.100.100.100
      detection_href:
        description: URL link to see the detection in the UI.
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/detections/1"
      detection_id:
        description: The ID of the detection.
        type: integer
        example: 1
      detection_type:
        description: The detection type.
        type: string
        example: Brute-Force
      entity_id:
        description: The ID of the entity.
        type: integer
        example: 1
      entity_name:
        description: The human-readable account or host name.
        type: string
        example: Admin Prod
      entity_uid:
        description: The UID of the entity.
        type: string
        example: "O365:email@domain.com"
      event_timestamp:
        description: Timestamp when the Entity Detection Event occurred.
        format: date-time
        type: string
      id:
        description: The ID of the Entity Detection Event.
        type: integer
        example: 1
      mitre:
        description: The mitre associted with the Detection Event.
        type: array
        items:
          type: string
          example: T1110
      severity:
        description: The severity of the detection.
        type: integer
        example: 5
      threat:
        description: The threat score attributed to the detection.
        type: integer
        example: 10
      triaged:
        description: Indicates whether the detection has been triaged.
        type: boolean
        example: false
      type:
        description: The type of the related entity for the event.
        type: string
        enum:
        - host
        - account
        example: account
      url:
        description: The URL associated with the detection entity.
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/accounts/1"
    type: object
  GroupDetections:
    type: object
    properties:
      id:
        type: integer
        example: 1
      name:
        type: string
        example: Example group name
      description:
        type: string
        example: Example description
      type:
        type: string
        enum:
        - ip
        - account
        - host
        - domain
        example: ip
      last_modified:
        format: date-time
        type: string
      last_modified_by:
        type: string
        example: "email@domain.com"
  AccountDetections:
    type: object
    properties:
      id:
        type: integer
        example: 1
      name:
        type: string
        example: "O365:email@domain.com"
      url:
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/api/v3/accounts/1"
      threat:
        type: integer
        example: 42
      certainty:
        type: integer
        example: 23
      privilege_level:
        type: integer
        example: 1
      privilege_category:
        type: string
        example: low
  HostDetection:
    type: object
    properties:
      id:
        type: integer
        example: 1
      name:
        type: string
        example: U02012340000939
      ip:
        type: string
        format: ipv4
        example: 100.100.100.100
      url:
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/api/v3.3/hosts/1"
      is_key_asset:
        type: boolean
      group:
        type: array
        items:
          $ref: '#/definitions/GroupDetections'
      threat:
        type: integer
        example: 10
      certainty:
        type: integer
        example: 10
  SummaryDetection:
    type: object
    properties:
      artifact:
        type: array
        items:
          type: string
          example: VHE8a543a95cbfeb09ca316xd9fv95b8880
      last_timestamp:
        type: string
        format: date-time
      description:
        type: string
        example: "Example description"
      roles:
        type: array
        items:
          type: string
          example: "Web Server"
  DetectionSerializerV3:
    properties:
      id:
        type: integer
        example: 1
      assigned_date:
        description: The timestamp when the user was assigned this detection.
        format: date-time
        type: string
      assigned_to:
        description: User named assigned to this detection.
        type: string
        example: "email@domain.com"
      c_score:
        description: Will be deprecated in future release. Replaced by certainty.
          The certainty score attributed to the detection.
        type: integer
        example: 30
      category:
        description: The category of the attack detected. Will be deprecated in future
          release. Replaced by detection_category.
        type: string
        enum:
        - botnet_activity
        - command_and_control
        - exfiltration
        - lateral_movement
        - reconnaissance
        - info
        example: info
      certainty:
        description: The certainty score attributed to the detection.
        type: integer
        example: 30
      created_timestamp:
        type: string
        format: date-time
      custom_detection:
        type: string
        example: "Testing"
      data_source:
        $ref: "#/definitions/DataSource"
      description:
        description: System-generated description of the event.
        type: string
        example: Example description
      detection:
        description: The name of the threat detected.
        type: string
        example: "Azure AD Unusual Scripting Engine Usage"
      detection_category:
        description: The category of the attack detected.
        type: string
        enum:
        - botnet_activity
        - command_and_control
        - exfiltration
        - lateral_movement
        - reconnaissance
        - info
      detection_type:
        description: The name of the threat detected.
        type: string
        example: "Azure AD Unusual Scripting Engine Usage"
      detection_url:
        description: A v3.0 URL to the Detection. Useful when using a web-based REST
          API browser. 
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/api/v3/detections/1"
      filtered_by_ai:
        description: Indicates whether the detection was filtered by an AI triage rule.
        type: boolean
        example: false
      filtered_by_rule:
        description: Indicates whether the detection was filtered by a triage rule.
        type: boolean
        example: true
      filtered_by_user:
        description: Indicates whether the detection was filtered by a user.
        type: boolean
        example: false
      first_timestamp:
        description: The timestamp when the event was first detected.
        format: date-time
        type: string
      grouped_details:
        description: The detection details for the detection.
        items:
          type: object
          description: The detail object has a flexible structure. Fields and types may vary by detection type.
          example:
            artifact: VHE8a543a95cbfeb09ca316xd9fv95b8880
            via: DHCP
            last_timestamp: "2025-01-21T18:40:36Z"
        type: array
      groups:
        type: array
        description: Groups associated with the detection.
        items:
          $ref: '#/definitions/GroupDetections'
      is_custom_model:
        description: Indicates whether the detection is using a custom model.
        type: boolean
        example: false
      is_marked_custom:
        type: boolean
        example: false
      is_targeting_key_asset:
        type: boolean
        example: false
      last_timestamp:
        description: The timestamp when the event was last detected.
        format: date-time
        type: string
      note:
        type: string
        example: Example note
      note_modified_by:
        type: string
        example: "email@domain.com"
      note_modified_timestamp:
        description: The timestamp when the note was last modified.
        format: date-time
        type: string
      notes:
        description: An array of all notes on the detection.
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      sensor:
        description: Name of the sensor where this flow was detected from. 
        type: string
        example: BofBd..g
      sensor_name:
        description: Name of the sensor where this flow was detected from.
        type: string
        example: Vectra Z
      src_account:
        description: Dictionary with fields describing the account from which the
          detection is sourced.
        $ref: '#/definitions/AccountDetections'
      src_ip:
        description: The source IP address of the host attributed to the security
          event. 
        type: string
        format: ipv4
      state:
        description: The state of the detection. If the detection has aged out, the
          state will transition from "active" to "inactive". If marked as fixed in
          the UI or via the V3.0 API, the state will be "fixed".
        type: string
        example: active
      summary:
        description: The detection summary. 
        $ref: '#/definitions/SummaryDetection'
      t_score:
        description: Will be deprecated in future release. Replaced by threat. The
          threat score attributed to the detection.
        type: integer
        example: 52
      tags:
        type: array
        items:
          type: string
          example: Example tag
      targets_key_asset:
        description: Indicates whether the detection targets a key asset. Will be
          deprecated in future release. Use is_targeting_key_asset.
        type: boolean
        example: false
      threat:
        description: The threat score attributed to the detection.
        type: integer
        example: 52
      triage_rule_id:
        type: integer
        example: 1
      url:
        description: A v3.0 URL to the Detection. Useful when using a web-based REST
          API browser.
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/api/v3/detections/1"
    type: object
  DetectionSerializerV3_3:
    properties:
      assigned_date:
        description: The timestamp when user was assigned this detection.
        format: date-time
        type: string
      assigned_to:
        description: The username assigned to this to the detection.
        type: string
        example: "email@domain.com"
      c_score:
        description: The certainty score attributed to the detection.
        type: integer
        example: 10
      category:
        description: Category of the detected attack. Deprecated in future releases;
          replaced by detection_category.
        type: string
        enum:
        - botnet_activity
        - command_and_control
        - exfiltration
        - lateral_movement
        - reconnaissance
        - info
        example: info
      certainty:
        description: Certainty score attributed to the detection. Deprecated in future
          releases; replaced by certainty.
        type: integer
        example: 10
      created_timestamp:
        description: Timestamp when the detection was created in GMT format. 
        type: string
        format: date-time
      custom_detection:
        description: Category name of the smart rule used to filter detection. 
        type: string
        x-nullable: true
        example: null
      data_source:
        description: Dictionary with fields describing the sensor, including type,
          connection_name, and connection_id.
        $ref: "#/definitions/DataSource"
        example: 
          type: network
          connection_name: ingest-prod-trail
          connection_id: k13bdhz0
      description:
        description: System-generated description of the event.
        type: string
        example: Example description
      detection:
        description: Name of the detected threat. 
        type: string
        example: "New Host Role"
      detection_category:
        description: Category of the detected attack. 
        type: string
        enum:
        - botnet_activity
        - command_and_control
        - exfiltration
        - lateral_movement
        - reconnaissance
        - info
        example: info
      detection_type:
        description: Type of the detected threat.
        type: string
        example: "New Host Role"
      detection_url:
        description: URL of the detection. 
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/api/v3/detections/1"
      filtered_by_ai:
        description: Indicates whether the detection was filtered by AI Triage. 
        type: boolean
        example: false
      filtered_by_rule:
        description: Indicates whether the detection was filtered by a triage rule. 
        type: boolean
        example: false
      filtered_by_user:
        description: Indicates whether the detection was filtered by a user.
        type: boolean
        example: false
      first_timestamp:
        description: Timestamp when the event was first detected in GMT format. 
        type: string
        format: date-time
      grouped_details:
        description: Detection details.
        items:
          type: object
          description: The detail object has a flexible structure. Fields and types may vary by detection type.
          example: 
            role: "Web Server"
            last_timestamp: "2025-02-24T16:17:30Z"
        type: array
      groups:
        description: Associated groups, rendering matching domain and IP Groups.
        items:
          $ref: '#/definitions/GroupDetections'
        type: array
      id:
        description: Unique identifier for the detection. 
        type: integer
        example: 1
      is_custom_model:
        description: Indicates whether the detection is a custom model. 
        type: boolean
        example: false
      is_marked_custom:
        description: Indicates whether the detection has custom filtering applied.
        type: boolean
        example: false
      is_targeting_key_asset:
        description: Indicates whether the detection targets a key asset. 
        type: boolean
        example: false
      is_triaged:
        description: Indicates whether the detection triaged. 
        type: boolean
        example: false
      last_timestamp:
        description: Timestamp when the event was last detected in GMT format. 
        format: date-time
        type: string
      note:
        description: User-defined note for this detection. 
        type: string
        example: Example note
      note_modified_by:
        description: Username who last modified the note. 
        type: string
        example: "email@domain.com"
      note_modified_timestamp:
        description: Timestamp when the note was last modified in GMT format.
        format: date-time
        type: string
      notes:
        description: Array of all notes on the detection.
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      sensor:
        description: Name of the sensor where this flow was detected from.
        type: string
        example: BofBd..g
      sensor_name:
        description: Name of the sensor where this flow was detected from. 
        type: string
        example: Vectra Z
      src_account:
        description: Dictionary with fields describing the account from which the
          detection is sourced. 
        $ref: '#/definitions/AccountDetections'
        x-nullable: true
        example: null
      src_host:
        description: Dictionary with fields describing the host from which the detection
          is sourced. 
        $ref: '#/definitions/HostDetection'
      src_ip:
        description: Source IP address of the host attributed to the security event.
        type: string
        format: ipv4
        example: 100.100.100.100
      state:
        description: State of the detection. If the detection has aged out, the state
          transitions from 'active' to 'inactive'. If marked as fixed, state is 'fixed'.
        type: string
        example: active
      summary:
        description: Summary information for the detection. 
        $ref: '#/definitions/SummaryDetection'
      t_score:
        description: Threat score attributed to the detection. Deprecated in future
          releases; replaced by threat.
        type: integer
        example: 10
      tags:
        description: User-defined tags added to the detection.
        type: array
        items:
          type: string
          example: Example tag
      targets_key_asset:
        description: Indicates whether the detection targets a key asset. Deprecated
          in future releases; use is_targeting_key_asset.
        type: boolean
        example: false
      threat:
        description: Threat score attributed to the detection. 
        type: integer
        example: 10
      triage_rule_id:
        description: Triage rule ID used for filtering. 
        type: integer
        x-nullable: true
        example: null
      type:
        description: Type of the detection. 
        type: string
        example: host
      url:
        description: URL that links directly to this record. 
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/api/v3/detections/1"
    type: object
  DetectionSerializerV3_4:
    properties:
      assigned_date:
        description: The timestamp when user was assigned this detection.
        format: date-time
        type: string
      assigned_to:
        description: The username assigned to this to the detection.
        type: string
        example: "email@domain.com"
      certainty:
        description: Certainty score attributed to the detection. 
        type: integer
        example: 10
      created_timestamp:
        description: Timestamp when the detection was created in GMT format.
        type: string
        format: date-time
      custom_detection:
        description: Category name of the smart rule used to filter detection.
        type: string
        x-nullable: true
        example: null
      data_source:
        description: Dictionary with fields describing the sensor, including type,
          connection_name, and connection_id. 
        $ref: "#/definitions/DataSource"
        example: 
          type: network
          connection_name: ingest-prod-trail
          connection_id: k13bdhz0
      description:
        description: System-generated description of the event.
        type: string
        example: Example description
      detection:
        description: Name of the detected threat. 
        type: string
        example: "New Host Role"
      detection_category:
        description: Category of the detected attack.
        type: string
        enum:
        - botnet_activity
        - command_and_control
        - exfiltration
        - lateral_movement
        - reconnaissance
        - info
        example: info
      detection_type:
        description: Type of the detected threat.
        type: string
        example: "New Host Role"
      detection_url:
        description: URL of the detection. 
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/api/v3/detections/1"
      filtered_by_ai:
        description: Indicates whether the detection was filtered by AI Triage.
        type: boolean
        example: false
      filtered_by_rule:
        description: Indicates whether the detection was filtered by a triage rule. 
        type: boolean
        examepl: false
      filtered_by_user:
        description: Indicates whether the detection was filtered by a user. 
        type: boolean
        example: false
      first_timestamp:
        description: Timestamp when the event was first detected in GMT format. 
        type: string
        format: date-time
      grouped_details:
        description: Detection details.
        items:
          type: object
          description: The detail object has a flexible structure. Fields and types may vary by detection type.
          example: 
            role: "Web Server"
            last_timestamp: "2025-02-24T16:17:30Z"
        type: array
      groups:
        description: Associated groups, rendering matching domain and IP Groups. 
        items:
          $ref: '#/definitions/GroupDetections'
        type: array
      id:
        description: Unique identifier for the detection.
        type: integer
        example: 1
      is_custom_model:
        description: Indicates whether the detection is a custom model. 
        type: boolean
        example: false
      is_marked_custom:
        description: Indicates whether the detection has custom filtering applied.
        type: boolean
        example: false
      is_triaged:
        description: Indicates whether the detection triaged. 
        type: boolean
        example: false
      last_timestamp:
        description: Timestamp when the event was last detected in GMT format.
        format: date-time
        type: string
      note:
        description: User-defined note for this detection.
        type: string
        example: Example note
      note_modified_by:
        description: Username who last modified the note. 
        type: string
        example: "email@domain.com"
      note_modified_timestamp:
        description: Timestamp when the note was last modified in GMT format.
        format: date-time
        type: string
      notes:
        description: A list of the ten most recent notes on the detection. The first note will be truncated to 1000 characters and following notes truncated to 100 characters. 
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      reason:
        description: Reason the detection was closed
        type: string
        example: remediated
      sensor:
        description: Name of the sensor where this flow was detected from. 
        type: string
        example: BofBd..g
      sensor_name:
        description: Name of the sensor where this flow was detected from.
        type: string
        example: Vectra Z
      src_account:
        description: Dictionary with fields describing the account from which the
          detection is sourced.
        $ref: '#/definitions/AccountDetections'
        x-nullable: true
        example: null
      src_host:
        description: Dictionary with fields describing the host from which the detection
          is sourced. 
        $ref: '#/definitions/HostDetection'
      src_ip:
        description: Source IP address of the host attributed to the security event.
        type: string
        format: ipv4
        example: 100.100.100.100
      src_groups:
        description: Groups associated with the source host, account or IP.
        items:
          $ref: '#/definitions/GroupDetections'
        type: array
      dst_groups:
        description: Groups associated with the destination domain or IP.
        items:
          $ref: '#/definitions/GroupDetections'
        type: array
      state:
        description: State of the detection. If the detection has aged out, the state
          transitions from 'active' to 'inactive'. If marked as fixed, state is 'fixed'.
        type: string
        example: active
      summary:
        description: Summary information for the detection. 
        title: Summary
        $ref: '#/definitions/SummaryDetection'
      tags:
        description: User-defined tags added to the detection. 
        type: array
        items:
          type: string
          example: Example tag
      is_targeting_key_asset:
        description: Indicates whether the detection targets a key asset. 
        type: boolean
        example: false
      threat:
        description: Threat score attributed to the detection.
        type: integer
        example: 10
      triage_rule_id:
        description: Triage rule ID used for filtering. 
        type: integer
        x-nullable: true
        example: null
      type:
        description: Type of the detection.
        format: date-time
        type: string
        example: host
      url:
        description: URL that links directly to this record. 
        type: string
        format: url
        example: "https://exampleurl.vectra.ai/api/v3/detections/1"
    type: object
  EntityScoringEventSerializerV3_1:
    properties:
      active_detection_types:
        description: A list of all active detection types on the entity.
        type: array
        items: 
          type: string
          example: "Azure AD Redundant Access Creation"
      breadth_contrib:
        description: Breadth contribution of the entity.
        type: integer
        example: 0
      category:
        description: The event category (e.g., 'ACCOUNT SCORING').
        type: string
        example: "ACCOUNT SCORING"
      entity_id:
        description: Entity ID.
        type: integer
        example: 1
      entity_importance:
        description: Importance score of the entity. To be deprecated in favor of
          'importance'.
        type: integer
        example: 1
      entity_type:
        description: Entity type, e.g., 'account', 'host'. To be deprecated in favor
          of 'type'.
        type: string
        example: account
      event_timestamp:
        description: Timestamp when the detection event occurred. Timestamp format-
          YYYY-MM-DD HH:MM-SS GMT.
        type: string
        format: date-time
      id:
        description: Unique identifier for the event.
        type: integer
        example: 1
      is_prioritized:
        description: Whether or not the priority of this entity is above the configured
          priority threshold.
        type: boolean
        example: false
      last_detection_id:
        description: To be deprecated in favor of 'last_detection'.
        type: integer
        example: 1
      last_detection_type:
        description: To be deprecated in favor of 'last_detection'.
        type: string
        example: "Azure AD Redundant Access Creation"
      last_detection_url:
        description: To be deprecated in favor of 'last_detection'.
        type: string
        example: "https://exampleurl.vectra.ai/detections/1"
      name:
        description: The name associated with the account or the learned hostname.
        type: string
        example: "O365:exampleprincipal_738c9930-2a05-4938-83ad-8a029e03zf4g"
      severity:
        description: Entity severity, e.g., 'Low', 'Medium', 'High'.
        type: string
        example: Low
      urgency_score:
        description: Priority or urgency of the entity.
        type: integer
        example: 30
      url:
        description: The URL link directly to this entity.
        type: string
        example: "https://exampleurl.vectra.ai/accounts/1"
      velocity_contrib:
        description: Velocity contribution of the entity.
        type: integer
        example: 0
    type: object
  EntityScoringEventSerializerV3_4:
    properties:
      active_detection_types:
        description: A list of all active detection types on the entity.
        type: array
        items:
          type: string
          example: "brute_force_i2i"
      attack_rating:
        description: Numeric representation of the severity of the attack
        type: integer
        example: 1
      breadth_contrib:
        description: Breadth contribution of the entity.
        type: integer
        example: 0
      category:
        description: The event category (e.g., 'ACCOUNT SCORING').
        type: string
        example: HOST_SCORING
      entity_id:
        description: Entity ID.
        type: integer
        example: 1
      event_timestamp:
        description: Timestamp when the detection event occurred. Timestamp format-
          YYYY-MM-DD HH:MM-SS GMT.
        type: string
        format: date-time
      id:
        description: Unique identifier for the event.
        type: integer
        example: 1
      importance:
        description: Importance score of the entity.
        type: integer
        example: 1
      is_prioritized:
        description: Whether or not the priority of this entity is above the configured
          priority threshold.
        type: boolean
        example: true
      last_detection:
        description: The id, type, and url of the last detection. This will replace
          last_detection_id, last_detection_type, and last_detection_url.
        properties:
          id:
            type: integer
            example: 1
          type:
            type: string
            example: "brute_force_i2i"
          url:
            type: string
            example: "https://exampleurl.vectra.ai/detections/1"
        type: object
      name:
        description: The name associated with the account or the learned hostname.
        type: string
        example: "IP-100.100.100.100"
      severity:
        description: Entity severity, e.g., 'Low', 'Medium', 'High'.
        type: string
        example: Medium
      type:
        description: Entity type, e.g., 'Account', 'Host'.
        type: string
        example: host
      urgency_score:
        description: Priority or urgency of the entity.
        type: integer
        example: 31
      url:
        description: The URL link directly to this entity.
        type: string
        example: "https://exampleurl.vectra.ai/hosts/1"
      velocity_contrib:
        description: Velocity contribution of the entity.
        type: integer
        example: 0
    type: object
  EntityScoringEventSerializerV3_3:
    properties:
      active_detection_types:
        description: A list of all active detection types on the entity.
        type: array
        items:
          type: string
          example: "brute_force_i2i"
      attack_rating:
        description: Numeric representation of the severity of the attack.
        type: integer
        example: 1
      breadth_contrib:
        description: Breadth contribution of the entity.
        type: integer
        example: 0
      category:
        description: The event category (e.g., 'ACCOUNT SCORING').
        type: string
        example: HOST_SCORING
      entity_id:
        description: Entity ID.
        type: integer
        example: 1
      entity_importance:
        description: Importance score of the entity. To be deprecated in favor of
          'importance'.
        type: integer
        example: 1
      entity_type:
        description: Entity type, e.g., 'Account', 'Host'. To be deprecated in favor
          of 'type'.
        type: string
        example: host
      event_timestamp:
        description: Timestamp when the detection event occurred. Timestamp format-
          YYYY-MM-DD HH:MM-SS GMT.
        type: string
        format: date-time
      id:
        description: Unique identifier for the event.
        type: integer
        example: 1
      importance:
        description: Importance score of the entity.
        type: integer
        example: 1
      is_prioritized:
        description: Whether or not the priority of this entity is above the configured
          priority threshold.
        type: boolean
        example: true
      last_detection:
        description: The id, type, and url of the last detection. This will replace
          last_detection_id, last_detection_type, and last_detection_url.
        properties:
          id:
            type: integer
            example: 1
          type:
            type: string
            example: "brute_force_i2i"
          url:
            type: string
            example: "https://exampleurl.vectra.ai/detections/1"
        type: object
      last_detection_id:
        description: To be deprecated in favor of 'last_detection'.
        type: integer
        example: 1
      last_detection_type:
        description: To be deprecated in favor of 'last_detection'.
        type: string
        example: "brute_force_i2i"
      last_detection_url:
        description: To be deprecated in favor of 'last_detection'.
        type: string
        example: "https://exampleurl.vectra.ai/detections/1"
      name:
        description: The name associated with the account or the learned hostname.
        type: string
        example: "IP-100.100.100.100"
      severity:
        description: Entity severity, e.g., 'Low', 'Medium', 'High'.
        type: string
        example: Medium
      type:
        description: Entity type, e.g., 'Account', 'Host'.
        type: string
        example: host
      urgency_score:
        description: Priority or urgency of the entity.
        type: integer
        example: 31
      url:
        description: The URL link directly to this entity.
        type: string
        example: "https://exampleurl.vectra.ai/hosts/1" 
      velocity_contrib:
        description: Velocity contribution of the entity.
        type: integer
        example: 0
    type: object
  EntitySerializerV3_1:
    properties:
      account_type:
        description: The method through which this account was discovered. 
        items:
          type: string
          example: o365
        type: array
      breadth_contrib:
        description: Breadth contribution of the entity. 
        type: integer
        example: 1
      detection_set:
        description: List of detections for this entity. 
        items:
          format: uri
          type: string
          example: "https://exampleurl.vectra.ai/api/v3.x/detections/1"
        type: array
        uniqueItems: true
      entity_importance:
        description: Importance score of the entity. 
        type: integer
        example: 1
      entity_type:
        description: Entity type, e.g., "account", "host". 
        type: string
        example: account
        enum:
        - account
        - host
      id:
        description: The entity id. 
        type: integer
        example: 1
        minimum: 1
      is_prioritized:
        description: Whether or not the priority of this entity is above the configured
          priority threshold. 
        type: boolean
        example: true
      last_detection_timestamp:
        description: Last detection activity from this entity. 
        type: string
        format: date-time
        example: '2025-03-03T10:46:38Z'
      name:
        description: The name associated with the account or the learned hostname.  
        type: string
        example: "O365:email@domain.com"
      notes:
        description: A list of all notes on the entity. 
          objects
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      privilege_category:
        description: A string to represent how privileged this account is, related
          to privilege level. Either Low (1-2), Medium (3-7), or High (8-10).
        type: string
        example: Low
        enum:
        - Low
        - Medium
        - High
      privilege_level:
        description: An integer from 1-10 to represent how privileges this account
          is. 
        type: string
        example: 1
        minimum: 1
        maximum: 10
      sensors:
        description: Sensors related to the entity. 
        items:
          type: string
          example: "p9u6gh09"
        type: array
      severity:
        description: Entity severity, e.g., "Low", "Medium", "High". 
        type: string
        example: High
        enum:
        - Low
        - Medium
        - High
      state:
        description: State of the entity, e.g., "active" or "inactive". 
        type: string
        example: active
        enum:
        - active
        - inactive
      tags:
        description: User-defined tags added to the entity. 
        items:
          type: string
          example: Example tag
        type: array
      urgency_score:
        description: Priority or urgency of the entity. 
        type: integer
        example: 76
      url:
        description: The URL link directly to this entity. 
        type: string
        example: "https://exampleurl.vectra.ai/accounts/1"
      velocity_contrib:
        description: Velocity contribution of the entity. 
        type: integer
        example: 2
    type: object
  EntityListSerializerV3_3:
    properties:
      account_type:
        description: The method through which this account was discovered ("kerberos"
          or "o365"). 
        items:
          type: string
          example: o365
        type: array
      assignment:
        description: Assignment object associated with the entity. 
        $ref: '#/definitions/AssignmentSummary'
        example: 
          id: 100
          assigned_by: 
            username: "email@domain.com"
            id: 20
          assigned_to:
            username: "email@domain.com"
            id: 20
          date_assigned: "2024-10-23T16:09:36Z"
      attack_profile:
        description: The associated attack profile. 
        type: string
        example: Ransomware
      attack_rating:
        description: The associated attack rating. 
        type: integer
        example: 10
      breadth_contrib:
        description: Breadth contribution of the entity. 
        type: integer
        example: 1
      detection_set:
        description: List of detections for this entity. 
        items:
          type: string
          example: "https://exampleurl.vectra.ai/api/v3.3/detections/1"
        type: array
      entity_importance:
        description: Importance score of the entity. 
        type: integer
        example: 1
      entity_type:
        description: Entity type, e.g., "account", "host". 
        type: string
        example: account
        enum:
        - account
        - host
      host_type:
        description: The host type if applicable.
        type: array
        items:
          type: string
        x-nullable: true
        example: null
      id:
        description: Autoincrementing ID. Entity ID. 
        type: integer
        example: 1
        minimum: 1
      importance:
        description: Importance score of the entity. 
        type: integer
        example: 1
      ip:
        description: Last seen IP address of host for "host" entity types, or null
          for "account" types. 
        type: string
        x-nullable: true
        example: null
      is_prioritized:
        description: Whether or not the priority of this entity is above the configured
          priority threshold. 
        type: boolean
        example: true
      last_detection_timestamp:
        description: Last detection activity from this entity.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      last_modified_timestamp:
        description: Last modification on this entity. 
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      name:
        description: The name associated with the account, or the learned hostname.  
        type: string
        example: "O365:email@domain.com"
      notes:
        description: A list of all notes on the entity. 
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      privilege_category:
        description: A string to represent how privileged this account is, related
          to privilege level. Either Low (1-2), Medium (3-7), or High (8-10).
        type: string
        example: Low
        enum:
        - Low
        - Medium
        - High
      privilege_level:
        description: An integer from 1-10 to represent how privileged this account
          is. 
        type: integer
        example: 1
        minimum: 1
        maximum: 10
      sensors:
        description: Sensors related to the entity. 
        items:
          type: string
          example: "p9u6gh09"
        type: array
      severity:
        description: Entity severity, e.g., "Low", "Medium", "High". 
        type: string
        example: High
        enum:
        - Low
        - Medium
        - High
      state:
        description: State of the entity, e.g., "active" or "inactive". 
        type: string
        example: active
        enum:
        - active
        - inactive
      tags:
        description: User-defined tags added to the entity. 
        items:
          type: string
          example: Example tag
        type: array
      type:
        description: Entity type, e.g., "account", "host". 
        type: string
        example: account
        enum:
        - account
        - host
      urgency_score:
        description: Priority or urgency of the entity. 
        type: integer
        example: 76
      url:
        description: The URL link directly to this entity. 
        type: string
        example: "https://exampleurl.vectra.ai/api/v3.3/accounts/1"
      velocity_contrib:
        description: Velocity contribution of the entity. 
        type: integer
        example: 2
    type: object
  EntityDetailSerializerV3_3:
    properties:
      account_type:
        description: The method through which this account was discovered ("kerberos"
          or "o365"). 
        items:
          type: string
          example: o365
        type: array
      assignment:
        description: Assignment object associated with the entity. 
        $ref: '#/definitions/Assignment'
        example: 
          id: 100
          assigned_by: 
            username: "email@domain.com"
            id: 20
          date_assigned: "2024-10-23T16:09:36Z"
          date_resolved: null
          events:
            - assignment_id: 100
              actor: 50
              event_type: created
              datetime: "2025-01-15T07:37:54Z"
              context:
                entity_t_score: 100
                entity_c_score: 85
                to: 26
          outcome: null
          resolved_by: null
          triaged_detections: []
          host_id: 1
          account_id: null
          assigned_to:
            username: "email@domain.com"
            id: 20
      attack_profile:
        description: The associated attack profile. 
        type: string
        example: Ransomware
      attack_rating:
        description: The associated attack rating. 
        type: integer
        example: 10
      breadth_contrib:
        description: Breadth contribution of the entity. 
        type: integer
        example: 1
      detection_set:
        description: List of detections for this entity. 
        items:
          type: string
          example: "https://exampleurl.vectra.ai/api/v3.3/detections/1"
        type: array
      entity_importance:
        description: Importance score of the entity. 
        type: integer
        example: 1
      entity_type:
        description: Entity type, e.g., "account", "host". 
        type: string
        example: account
        enum:
        - account
        - host
      host_type:
        description: The host type if applicable.
        type: array
        items:
          type: string
        x-nullable: true
        example: null
      id:
        description: Autoincrementing ID. Entity ID. 
        type: integer
        example: 1
        minimum: 1
      importance:
        description: Importance score of the entity. 
        type: integer
        example: 1
      ip:
        description: Last seen IP address of host for "host" entity types, or null
          for "account" types. 
        type: string
        x-nullable: true
        example: null
      is_prioritized:
        description: Whether or not the priority of this entity is above the configured
          priority threshold. 
        type: boolean
        example: true
      last_detection_timestamp:
        description: Last detection activity from this entity.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      last_modified_timestamp:
        description: Last modification on this entity. 
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      name:
        description: The name associated with the account, or the learned hostname.  
        type: string
        example: "O365:email@domain.com"
      notes:
        description: A list of all notes on the entity. 
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      privilege_category:
        description: A string to represent how privileged this account is, related
          to privilege level. Either Low (1-2), Medium (3-7), or High (8-10).
        type: string
        example: Low
        enum:
        - Low
        - Medium
        - High
      privilege_level:
        description: An integer from 1-10 to represent how privileged this account
          is. 
        type: integer
        example: 1
        minimum: 1
        maximum: 10
      sensors:
        description: Sensors related to the entity. 
        items:
          type: string
          example: "p9u6gh09"
        type: array
      severity:
        description: Entity severity, e.g., "Low", "Medium", "High". 
        type: string
        example: High
        enum:
        - Low
        - Medium
        - High
      state:
        description: State of the entity, e.g., "active" or "inactive". 
        type: string
        example: active
        enum:
        - active
        - inactive
      tags:
        description: User-defined tags added to the entity. 
        items:
          type: string
          example: Example tag
        type: array
      type:
        description: Entity type, e.g., "account", "host". 
        type: string
        example: account
        enum:
        - account
        - host
      urgency_score:
        description: Priority or urgency of the entity. 
        type: integer
        example: 76
      url:
        description: The URL link directly to this entity. 
        type: string
        example: "https://exampleurl.vectra.ai/api/v3.3/accounts/1"
      velocity_contrib:
        description: Velocity contribution of the entity. 
        type: integer
        example: 2
    type: object
  EntityListSerializerV3_4:
    properties:
      account_type:
        description: The method through which this account was discovered ("kerberos"
          or "o365"). 
        items:
          type: string
          example: o365
        type: array
      assignment:
        description: Assignment object associated with the entity. 
        $ref: '#/definitions/AssignmentSummary'
        example: 
          id: 100
          assigned_by: 
            username: "email@domain.com"
            id: 20
          date_assigned: "2024-10-23T16:09:36Z"
          assigned_to:
            username: "email@domain.com"
            id: 20
      attack_profile:
        description: The associated attack profile. 
        type: string
        example: Ransomware
      attack_rating:
        description: The associated attack rating. 
        type: integer
        example: 10
      breadth_contrib:
        description: Breadth contribution of the entity. 
        type: integer
        example: 1
      detection_set:
        description: List of detections for this entity. 
        items:
          type: string
          example: "https://exampleurl.vectra.ai/api/v3.3/detections/1"
        type: array
      entity_importance:
        description: Importance score of the entity. 
        type: integer
        example: 1
      entity_type:
        description: Entity type, e.g., "account", "host". 
        type: string
        example: account
        enum:
        - account
        - host
      host_type:
        description: The host type if applicable.
        type: array
        items:
          type: string
        x-nullable: true
        example: null
      id:
        description: Autoincrementing ID. Entity ID. 
        type: integer
        example: 1
        minimum: 1
      importance:
        description: Importance score of the entity. 
        type: integer
        example: 1
      ip:
        description: Last seen IP address of host for "host" entity types, or null
          for "account" types. 
        type: string
        x-nullable: true
        example: null
      is_prioritized:
        description: Whether or not the priority of this entity is above the configured
          priority threshold. 
        type: boolean
        example: true
      last_detection_timestamp:
        description: Last detection activity from this entity.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      last_modified_timestamp:
        description: Last modification on this entity. 
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      name:
        description: The name associated with the account, or the learned hostname.  
        type: string
        example: "O365:email@domain.com"
      notes:
        description: A list of all notes on the entity. 
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      privilege_category:
        description: A string to represent how privileged this account is, related
          to privilege level. Either Low (1-2), Medium (3-7), or High (8-10).
        type: string
        example: Low
        enum:
        - Low
        - Medium
        - High
      privilege_level:
        description: An integer from 1-10 to represent how privileged this account
          is. 
        type: integer
        example: 1
        minimum: 1
        maximum: 10
      sensors:
        description: Sensors related to the entity. 
        items:
          type: string
          example: "p9u6gh09"
        type: array
      severity:
        description: Entity severity, e.g., "Low", "Medium", "High". 
        type: string
        example: High
        enum:
        - Low
        - Medium
        - High
      state:
        description: State of the entity, e.g., "active" or "inactive". 
        type: string
        example: active
        enum:
        - active
        - inactive
      tags:
        description: User-defined tags added to the entity. 
        items:
          type: string
          example: Example tag
        type: array
      type:
        description: Entity type, e.g., "account", "host". 
        type: string
        example: account
        enum:
        - account
        - host
      urgency_score:
        description: Priority or urgency of the entity. 
        type: integer
        example: 76
      url:
        description: The URL link directly to this entity. 
        type: string
        example: "https://exampleurl.vectra.ai/api/v3.3/accounts/1"
      velocity_contrib:
        description: Velocity contribution of the entity. 
        type: integer
        example: 2
    type: object
  EntityDetailSerializerV3_4:
    properties:
      account_type:
        description: The method through which this account was discovered ("kerberos"
          or "o365") if applicable. 
        items:
          type: string
          example: o365
        type: array
      assignment:
        description: Assignment object associated with the entity. 
        $ref: '#/definitions/Assignment'
        example: 
          id: 100
          assigned_by: 
            username: "email@domain.com"
            id: 20
          date_assigned: "2024-10-23T16:09:36Z"
          date_resolved: null
          events:
            - assignment_id: 100
              actor: 50
              event_type: created
              datetime: "2025-01-15T07:37:54Z"
              context:
                entity_t_score: 100
                entity_c_score: 85
                to: 26
          outcome: null
          resolved_by: null
          triaged_detections: []
          host_id: 1
          account_id: null
          assigned_to:
            username: "email@domain.com"
            id: 20
      attack_profile:
        description: The associated attack profile. 
        type: string
        example: Ransomware
      attack_rating:
        description: The associated attack rating. 
        type: integer
        example: 10
      breadth_contrib:
        description: Breadth contribution of the entity. 
        type: integer
        example: 1
      detection_set:
        description: List of detections for this entity. 
        items:
          type: string
          example: "https://exampleurl.vectra.ai/api/v3.4/detections/1"
        type: array
      host_type:
        description: The host type if applicable.
        type: array
        items:
          type: string
        x-nullable: true
        example: null
      id:
        description: Autoincrementing ID. Entity ID. 
        type: integer
        example: 1
        minimum: 1
      importance:
        description: Importance score of the entity. 
        type: integer
        example: 1
      ip:
        description: Last seen IP address of host for "host" entity types, or null
          for "account" types. 
        type: string
        x-nullable: true
        example: null
        format: ipv4
      is_prioritized:
        description: Whether or not the priority of this entity is above the configured
          priority threshold. 
        type: boolean
        example: true
      last_detection_timestamp:
        description: Last detection activity from the entity.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      last_modified_timestamp:
        description: Last modification on this entity.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      name:
        description: The name associated with the account, or the learned hostname. 
        type: string
        example: "O365:email@domain.com"
      notes:
        description: A list of the ten most recent notes on the entity. The first note will be truncated to 1000 characters and following notes truncated to 100 characters. 
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      privilege_category:
        description: A string to represent how privileged this account is, related
          to privilege level. Either Low (1-2), Medium (3-7), or High (8-10). 
          string
        type: string
        example: Low
        enum:
        - Low
        - Medium
        - High
      privilege_level:
        description: An integer from 1-10 to represent how privileged this account
          is. 
        type: integer
        example: 1
        minimum: 1
        maximum: 10
      sensors:
        description: Sensors related to the entity. 
        items:
          type: string
          example: "p9u6gh09"
        type: array
      severity:
        description: Entity severity, e.g., "Low", "Medium", "High". 
        type: string
        example: High
        enum:
        - Low
        - Medium
        - High
      state:
        description: State of the entity, e.g., "active" or "inactive". 
        type: string
        example: active
        enum:
        - active
        - inactive
      tags:
        description: User-defined tags added to the entity. 
        type: array
        items:
          type: string
          example: Example tag
      type:
        description: Entity type, e.g., "account", "host". 
        type: string
        example: account
        enum:
        - account
        - host
      urgency_score:
        description: Priority or urgency of the entity. 
        type: integer
        example: 76
      url:
        description: The URL link directly to this entity. 
        type: string
        example: "https://exampleurl.vectra.ai/api/v3.4/accounts/1"
      velocity_contrib:
        description: Velocity contribution of the entity. 
        type: integer
        example: 2
    type: object
  GroupSerializerV3_2:
    properties:
      description:
        description: User defined description of the group. 
        type: string
        example: Example description
      id:
        description: Group ID.
        type: integer
        example: 1
      importance:
        description: User defined group importance. 
        type: string
        example: medium
        enum:
          - high
          - medium
          - low
          - never_prioritize
      last_modified:
        description: The time when the group was last modified. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z).
        format: date-time
        type: string
      last_modified_by:
        description: The last user that modified the group. 
        type: string
        example: "email@domain.com"
      members:
        description: The list of group members.
        items:
          type: object
          example: 
            uid: "O365:email@domain.com"
        type: array
      name:
        description: The group name. 
        type: string
        example: Example Account Group
      rules:
        description: The list of Triage Rules that the group is attatched to.
        items:
          type: object
          properties:
            id:
              type: integer
              example: 1
            triage_category: 
              example: Benign Detection
              type: string
            description: 
              example: "Example description"
              type: string
        type: array
      type:
        description: The group membership type. 
        enum:
        - host
        - domain
        - ip
        - account
        type: string
        example: account
    type: object
  GroupSerializerV3_4:
    properties:
      id:
        description: Group ID. 
        type: integer
        example: 1
      ad_group_dn: 
        description: The distinguished name of the AD Group. This field is only populated for AD Groups.
        type: string
        example: "CN=Users,DC=domain,DC=com"
      built_using:
        description: The group creation method. 
        type: string
        example: regex
        enum:
        - AD
        - regex
        - static_members
      cognito_mananged:
        description: Whether or not a group is managed by Cognito. Will be available as a field in the response as 'true' if Cognito managed and excluded if not Cognito managed.
        type: string
        example: 'true'
      description:
        description: User defined description of the group.
        type: string
        example: Example description
      importance:
        description: User defined group importance.
        type: string
        example: medium
        enum:
          - high
          - medium
          - low
          - never_prioritize
      last_modified:
        description: The time when the group was last modified.
        format: date-time
        type: string
      last_modified_by:
        description: The last user that modified the group.
        type: string
        example: "email@domain.com"
      member_count:
        description: The number of members in the group.
        example: 1
        type: integer
      membership_evaluation_ongoing:
        description: Flags if the Dynamic Group is undergoing membership evaluations.
        type: boolean
        example: false
      members:
        description: |
          The list of group members. Note that for Dynamic Groups, only active members will be listed. 
          A member that has been removed from the group due to inactivity will be added back to the group upon becoming active again.
        items:
          type: object
          example: 
            uid: "O365:email@domain.com"
        type: array
      name:
        description: The group name. 
        type: string
        example: Example Account Group
      regex:
        description: The regex used to match members of the group. This field is only populated for Dynamic Groups.
        type: string
        example: "[\\w\\d]*@domain.com"
        x-nullable: true
      rules:
        description: The list of Triage Rules that the group is attached to.
        items:
          type: object
          properties:
            id:
              type: integer
              example: 1
            triage_category: 
              example: Benign Detection
              type: string
            description: 
              example: "Example description"
              type: string
        type: array
      type:
        description: The group membership type.
        enum:
        - host
        - domain
        - ip
        - account
        type: string
        example: account
    type: object
  GroupMemberHostV3_4:
    properties:
      id:
        description: Group ID.
        type: integer
        example: 1
      name:
        description: The name of the Host.
        type: string
      is_key_asset:
        description: Whether or not the Host is a key asset. 
        type: string
        example: True
      url:
        description: An API URL linking to the Host entity. 
        type: string
        example: "https://VECTRA_PORTAL_URL/api/v3.4/groups/89/members?page=2"
    type: object
  GroupMemberAccountV3_4:
    properties:
      uid:
        description: The unique ID of the Account entity.
        type: string
        example: example_account@vectra.ai
    type: object
  GroupMemberIPV3_4:
    properties:
      ip:
        description: The IP member.
        type: string
        example: '1.12.1001.1'
    type: object
  GroupMemberDomainV3_4:
    properties:
      domain:
        description: The domain member.
        type: string
        example: '*.salesforce.com'
    type: object
  SettingsActiveDirectoryGroupsSerializerV3_4:
    properties:
      ad_profile_name:
        description: The name of the connected AD profile.
        type: string
        example: test_ad
      dn: 
        description: The distinguished name.
        type: string
        example: "CN=Users,DC=domain,DC=com"
      existing_host_group:
        description: Whether this AD group is imported as a Vectra AD host group.
        type: boolean
        example: true
      existing_account_group:
        description: Whether this AD group is imported as a Vectra AD account group.
        type: boolean
        example: false
    type: object
  HealthSerializerV3_3:
    title: Success
    type: object
    properties:
      memory:
        title: Memory
        description: System memory information. 
        type: object
        properties:
          usage_percent:
            type: float
            example: 50.1
          free_bytes:
            type: integer
            example: 15208275968
          used_bytes:
            type: integer
            example: 86038298624
          total_bytes:
            type: integer
            example: 202373320704
          updated_at:
            type: string
            example: '2025-03-03T10:46:38Z'
            format: date-time
          dimm_status:
            type: array
            items:
              type: object
              properties:
                dimm:
                  type: string
                  example: "lc1"
                status:
                  type: string
                  example: OK
      trafficdrop:
        title: Traffic Drop
        description: Sensor output is only shown if traffic has
          gone out of baseline. 
        type: object
        properties:
          sensors:
            type: array
            items:
              type: object
              properties:
                name:
                  type: string
                  example: V9e15efry3b8934123b8d3e66b79ghj45
                ip_address:
                  type: string
                  format: ipv4
                  example: 100.100.100.100
                luid:
                  type: string
                  example: "h9ki54x5"
                error:
                  type: string
                  example: "All interfaces have traffic volume within range"
                status:
                  type: string
                  enum:
                  - OK
                  - WARNING
                  - UNKNOWN
                  - SKIP
                  example: OK
                serial_number:
                  type: string
                  example: V9e15efry3b8934123b8d3e66b79ghj45
                output:
                  type: array
                  example: []
                  items:
                    type: object
                    properties:
                      start:
                        type: string
                      end:
                        type: string
                      interfaces:
                        type: array
                        items:
                          type: object
                          properties:
                            baseline:
                              type: integer
                            cutoff:
                              type: integer
                            name:
                              type: string
                            traffic:
                              type: integer
      cpu:
        title: CPU
        description: Processor information. 
        type: object
        properties:
          user_percent:
            type: float
            description: Percent of CPU processing tasks. 
            example: 50.6
          nice_percent:
            type: float
            description: Percent of CPU processing higher prioritized
              tasks. 
            example: 0.0
          system_percent:
            type: float
            description: Percent of CPU processing system specific
              tasks. 
            example: 1.8
          idle_percent:
            type: float
            description: Percent of CPU idle. 
            example: 47.3
      hostid:
        title: Host id
        description: Host information. 
        type: object
        properties:
          ip_always_percent:
            type: float
            description: Number of IP addresses that are always
              covered by Host ID when seen on the network. 
            example: 11.87
          ip_sometimes_percent:
            example: 27.0
            type: float
            description: Number of IP addresses that are sometimes
              covered by Host ID when seen on the network. 
          ip_never_percent:
            example: 61.13
            type: float
            description: Number of IP addresses that are never
              covered by Host ID when seen on the network. 
          artifact_counts:
            type: object
            description: Calculated weekly. 
            properties:
              TestEDR:
                type: integer
                example: 0
              arsenic:
                type: integer
                example: 0
              carbon_black:
                type: integer
                example: 0
              cb_cloud:
                type: integer
                example: 0
              clear_state:
                type: integer
                example: 1
              cookie:
                type: integer
                example: 4
              crowdstrike:
                type: integer
                example: 0
              cybereason:
                type: integer
                example: 0
              dhcp:
                type: integer
                example: 161443
              dns:
                type: integer
                example: 58853354
              end_time:
                type: integer
                example: 0
              fireeye:
                type: integer
                example: 0
              generic_edr:
                type: integer
                example: 0
              idle_end:
                type: integer
                example: 192365
              idle_start:
                type: integer
                example: 192212
              invalid:
                type: integer
                example: 0
              kerberos:
                type: integer
                example: 117231
              kerberos_user:
                type: integer
                example: 123
              mdns:
                type: integer
                example: 12312
              netbios:
                type: integer
                example: 897123
              proxy_ip:
                type: integer
                example: 0
              rdns:
                type: integer
                example: 0
              sentinelone:
                type: integer
                example: 0
              split:
                type: integer
                example: 3
              src_port:
                type: integer
                example: 0
              static_ip:
                type: integer
                example: 0
              total:
                type: integer
                example: 102045351
              uagent:
                type: integer
                example: 102045276
              vmachine_info:
                type: integer
                example: 0
              windows_defender:
                type: integer
                example: 0
              zpa_user:
                type: integer
                example: 0
      network:
        title: Network
        description: System network information. 
        type: object
        properties:
          interfaces:
            type: object
            description: Link speed shown in megabits per sec. 
            properties:
              brain:
                type: object
                example:
                  eth0:
                    link: UP
                    speed_mbps: 1000
                    duplex: FULL
                    link_stable: true
              sensor:
                type: object
                example: 
                  h6ji72y3:
                    eth0:
                      link: UP
          traffic:
            type: object
            description: Link speed shown in megabits per sec. 
            properties:
              brain:
                type: object
                example:
                  aggregated_peak_traffic_mbps: 600
                  interface_peak_traffic:
                    eth0:
                      peak_traffic_mbps: 600
              sensor:
                type: object
                example:
                  V9e15efry3b8934123b8d3e66b79ghj45:
                    aggregated_peak_traffic_mbps: 20
                    interface_peak_traffic:
                      eth0:
                        peak_traffic_mbps: 20
          updated_at:
            type: string
            example: '2025-03-03T10:46:38Z'
            format: date-time
          vlans:
            type: object
            properties:
              vlan_ids:
                type: array
                items:
                  type: integer
                  example: 50
              count:
                type: integer
                example: 1
      disk:
        title: Disk
        description: System disk information. 
        type: object
        properties:
          disk_utilization:
            description: Includes free, used, total, and usage
              percentage of filesystem in bytes. 
            type: object
            properties:
              total_bytes:
                type: integer
                example: 67049664512
              free_bytes:
                type: integer
                example: 43695415296
              used_bytes:
                type: integer
                example: 23354249216
              usage_percentage:
                type: float
                example: 34.83
          raid_disks_missing:
            description: Optional health status and errors, if any. 
            type: object
            properties:
              output:
                type: object
                example: {}
              error:
                type: string
                example: All RAID disks are present.
              status:
                type: string
                example: OK
          degraded_raid_volume:
            description: Optional health status and errors, if any. 
            type: object
            properties:
              output:
                example: []
                type: array
                items:
                  type: string
              error:
                type: string
                example: "Stripe volumes are healthy."
              status:
                type: string
                example: OK
          disk_raid:
            description: Optional health status and errors, if any. 
            type: object
            properties:
              output:
                type: string
                example: ""
              error:
                type: string
                example: "RAID volumes and disk OK on V9e15efry3b8934123b8d3e66b79ghj45"
              status:
                type: string
                example: OK
      power:
        title: Power
        description: Power supply information. 
        type: object
        properties:
          status:
            type: string
            example: WARNING
          error:
            type: string
            description: Optional power supply errors, if any. 
            example: Power supply issues detected
          power_supplies:
            type: object
            description: List of power supplies and temperature
              information. 
            example: 
              1:
                faults:
                - Power Supply AC lost
                present: true
          updated_at:
            type: string
            example: '2025-03-03T10:46:38Z'
            format: date-time
      system:
        title: System
        description: System information. 
        type: object
        properties:
          uptime:
            type: string
            example: "27 days, 1 hours, 39 minutes"
          serial_number:
            type: string
            example: V9e15efry3b8934123b8d3e66b79ghj45
          version:
            description: Includes date of last update, version,
              mode, and mode. 
            type: object
            properties:
              last_update:
                type: string
                format: date-time
              model:
                type: string
                example: X29v2
              mode:
                type: string
                example: mixed
              cloud_bridge:
                type: boolean
                example: true
              gmt:
                type: string
                format: date-time
              vectra_version:
                type: string
                example: "7.9.0-12-26"
          updated_at:
            type: string
            example: '2025-03-03T10:46:38Z'
            format: date-time
      connectivity:
        title: Connectivity
        description: Connectivity information. 
        type: object
        properties:
          sensors:
            type: array
            items:
              type: object
              properties:
                output:
                  type: object
                  properties:
                    last_check:
                      type: string
                      format: date-time
                affected_metadata_hours:
                  type: string
                  description: Field not present if status is 'OK'. 
                error:
                  type: string
                  example: metadata replication seems fine
                status:
                  type: string
                  enum:
                  - OK
                  - WARNING
                  - UNKNOWN
                  - SKIP
                  example: OK
                name:
                  type: string
                  example: V9e15efry3b8934123b8d3e66b79ghj45
                serial_number:
                  type: string
                  example: V9e15efry3b8934123b8d3e66b79ghj45
                luid:
                  type: string
                  example: "h9ki54x5"
                ip_address:
                  type: string
                  example: 100.100.100.100
                  format: ipv4
      sensors:
        title: Sensor
        description: Sensor information. 
        type: array
        items:
          type: object
          properties:
            status:
              type: string
              example: paired
            name:
              type: string
              example: V9e15efry3b8934123b8d3e66b79ghj
            serial_number:
              type: string
              example: V9e15efry3b8934123b8d3e66b79ghj
            version:
              type: string
              example: "7.5.0-15-25"
            last_seen:
              type: string
              format: date-time
            ip_address:
              type: string
              format: ipv4
              example: 100.100.100.100
            luid:
              type: string
              example: "h9ki54x5" 
            location:
              type: string
              example: Austin
            id:
              type: integer
              example: 1
            ssh_tunnel_port:
              type: string
              example: 90283
            public_key:
              type: string
              example: -----BEGIN PUBLIC KEY-----\sPKKLTgANJf
            product_name:
              type: string
              example: DCS
            mode:
              type: string
              example: sensor
            headend_uri:
              type: string
              example: 100.100.100.101
            original_version:
              type: string
              example: "7.5.0-15-25"
            updated_count:
              type: integer
              example: 0
  HealthDetectionSerializerV3_4:
    type: object
    properties:
      detection:
        title: Detection
        description: Detection Model Health. 
        type: object
        example: {}
        properties:
          check_results:
            type: array
            items:
              type: object
              properties:
                name:
                  type: string
                detection_type:
                  type: string
                message:
                  type: string
                status:
                  type: string
  HealthSerializerV3_4:
    title: Success
    allOf:
      - $ref: "#/definitions/HealthDetectionSerializerV3_4"
      - $ref: "#/definitions/HealthSerializerV3_3"
  SingleAccountSerializerV3_4:
    allOf:
      - $ref: "#/definitions/AccountSerializerV3_4"
      - $ref: "#/definitions/AccountLDAP"
      - $ref: "#/definitions/AccountHostAccessHistory"
  SingleAccountSerializerV3_3:
    allOf:
      - $ref: "#/definitions/AccountSerializerV3_3"
      - $ref: "#/definitions/AccountLDAP"
      - $ref: "#/definitions/AccountHostAccessHistory"
  SingleAccountSerializerV3_2:
    allOf:
      - $ref: "#/definitions/AccountSerializerV3_2"
      - $ref: "#/definitions/AccountLDAP"
      - $ref: "#/definitions/AccountHostAccessHistory"
  SingleAccountSerializerV3:
    allOf:
      - $ref: "#/definitions/AccountSerializerV3"
      - $ref: "#/definitions/AccountLDAP"
      - $ref: "#/definitions/AccountHostAccessHistory"
  SingleHostSerializerV3_3:
    allOf:
      - $ref: "#/definitions/HostSerializerV3_3"
      - $ref: "#/definitions/SingleHostOnlySerializerV3_3"
  SingleHostOnlySerializerV3_3:
    properties:
      account_access_history:
        description: Returns information on the account access history for the host.
          Always returned unless the query param include_access_history is false.
        type: array
        items:
          type: object
          properties:
            id:
             type: integer
             example: 1
            uid:
              type: sting
              example: "example@domain.com"
            privilege:
              type: integer
              example: 1
            privilege_category:
              type: string
              example: Low
            last_seen: 
              type: string
              format: date-time
              example: "2025-03-06T17:07:53Z"
      campaign_summaries:
        type: array
        description: Summary of campaigns associated with the host.
        example: []
      carbon_black:
        type: object
        description: Information on the EDR Carbon Black.
          Only returned when the query param include_edrs is true.
        example:
          is_connected: false
      crowdstrike:
        type: object
        description: Information on the EDR CrowdStrike.
        example:
          is_connected: false
        x-nullable: true
      edrs:
        type: array
        description: List of EDRs associated with the host.
          Only returned when the query param include_edrs is true.
        items:
          type: string
          example: CrowdStrike
      has_shell_knocker_learnings:
        type: boolean
        description: Flags if the host has shell knocker learnings.
        example: true
      last_seen:
        description: The last seen packet capture of the host's latest host session.
        type: string
        format: date-time
      ldap:
        description: Information about the LDAP server this host came from (if applicable).
          Only retuend if the include_ldap query param is set to true.
        type: object
        example: 
          pwdLastSet: "2019-07-31 18:23:39.419313+00:00"
        x-nullable: true
      roles:
        type: array
        description: Roles associated with the host.
        items:
          type: string
          example: Proxy Server 
      service_access_history:
        description: Returns information on the access history for the host.
          Always returned unless the query param include_access_history is false.
        type: array
        items:
          type: object
          properties:
            id:
             type: integer
             example: 1
            uid:
              type: sting
              example: "lmttgt/example@domain.com"
            privilege:
              type: integer
              example: 1
            privilege_category:
              type: string
              example: Low
            last_seen: 
              type: string
              format: date-time
              example: "2025-03-06T17:07:53Z"
      suspicious_admin_learnings:
        type: object
        description: Managers and managees of a given host.
        example:
          managers_of_host: []
          host_manages: []
      shell_knocker:
        description: The list of shellknocker ports on this host.        
        type: array
        items:
          type: object
          properties:
            port:
              type: integer
              example: 53
            protocol:
              type: string
              example: dns
      vcenter:
        type: object
        description: Information on the external connector vCenter. 
          Only returned when the query param include_external is true.
        example:
          is_connected: false
        x-nullable: true
  HostArtifact:
    properties:
      siem:
        title: Siem
        type: boolean
        example: false
      source:
        title: Source
        type: string
        example: null
        x-nullable: true
      type:
        title: Type
        type: string
        example: dhcp
      value:
        title: Value
        type: string
        example: "y90-4-78.sc.tvec"
    required:
    - type
    - value
    type: object
  HostSerializerV3_4:
    properties:
      active_traffic:
        description: Whether a host has active traffic. 
        type: boolean
        example: true
      assigned_date:
        description: Date when assignment was made. 
        format: date-time
        type: string
        example: '2025-03-06T15:46:38Z'
      assigned_to:
        description: Current user assigned to host. 
        type: string
        example: "email@domain.com"
      assignment:
        description: Assignment object associated with host. 
        $ref: '#/definitions/Assignment'
        example: 
          id: 100
          assigned_by: 
            username: "email@domain.com"
            id: 20
          date_assigned: "2024-10-23T16:09:36Z"
          date_resolved: null
          events:
            assignment_id: 100
            actor: 50
            event_type: created
            datetime: "2025-01-15T07:37:54Z"
            context:
              entity_t_score: 100
              entity_c_score: 85
              to: 26
            outcome: null
            resolved_by: null
            triaged_detections: []
            host_id: 1
            account_id: null
            assigned_to:
              username: "email@domain.com"
              id: 20
      c_score:
        description: Same as 'certainty'. 
        type: integer
        example: 30
        minimum: 0
        maximum: 100
      certainty:
        description: The calculated certainty of the host. 
        type: integer
        example: 30
        minimum: 0
        maximum: 100
      detection_profile:
        description: Associated detection profile. 
        type: string
        example: "Potentially Unwanted Program"
      detection_set:
        description: List of detection urls for this host. 
        items:
          type: string
          format: url
          example: "https://exampleurl.vectra.ai/api/v3.3/detections/1"
        type: array
      detection_summaries:
        description: List of detection summaries associated with the host. This is only included when 
          the param include_detection_summaries is set to true.
        type: array
        items: 
          $ref: '#/definitions/DetectionSummary'
          example: 
            detection_id: 1
            detection_url: "https://exampleurl.vectra.ai/api/v3.3/detections/1"
            detection_type: "Novel External Destination Port"
            detection_category: "INFO"
            is_targeting_key_asset: false
            state": "active"
            threat: 0
            certainty: 0
            is_triaged: false
            tags: []
            summary:
              target_domains: []
              dst_ips:
                - 100.100.100.100
              protocol_ports:
                - udp:8080
              description: "This host was seen making an outbound connection on a destination port that is rare for the environment and lasted longer than 5 minutes."
            assigned_to: null
            assigned_date: null
      groups:
        description: List of groups associated with the host. 
        items:
          $ref: '#/definitions/GroupDetections'
          example:
            id: 100
            name: Example host group
            description: Example description
            last_modified: "2024-01-23T21:22:49Z"
            last_modified_by: "email@domain.com"
            type: host
        type: array
      has_active_traffic:
        description: Whether a host has active traffic. 
        type: boolean
        example: true
      has_custom_model:
        description: Whether the host has a custom model. 
        type: boolean
        example: false
      host_artifact_set:
        description: A list of associated artifacts. 
        items:
          $ref: '#/definitions/HostArtifact'
        type: array
      host_luid:
        description: Luid associated with host. 
        type: string
        example: "KLOZdusj"
      host_session_luids:
        description: List of luids for corresponding host sessions. 
        items:
          type: string
          example: Bt972vKL
        type: array
      id:
        description: Host id.
        type: integer
        example: 1
        minimum: 1
      ip:
        description: IP address for the host. 
        type: string
        format: ipv4
        example: 100.100.100.100
      is_key_asset:
        description: Whether the host is a key asset. 
        type: boolean
        example: false
      is_targeting_key_asset:
        description: Whether the host is targeting a key asset. 
        type: boolean
        example: false
      key_asset:
        description: Whether the host is a key asset. 
        type: boolean
        example: false
      last_detection_timestamp:
        description: Last detection activity from this host.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      last_modified:
        description: Time the host was last modified. 
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      last_source:
        description: Last source IP associated with host. 
        type: string
        example: 100.100.100.100
      name:
        description: The name associated with the host.    
        type: string
        example: "jl-lopspec-12"
      note:
        description: Note attached to the host. 
        type: string
        example: Example note
      note_modified_by:
        description: Last user to modify note for host. 
        type: string
        example: "email@domain.com"
      note_modified_timestamp:
        description: Last time the note was modified.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      notes:
        description: A list of the ten most recent notes on the host. The first note will be truncated to 1000 characters and following notes truncated to 100 characters. 
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      past_assignments:
        description: List of past assignments. 
        items:
          $ref: '#/definitions/Assignment'
          example: 
            id: 100
            assigned_by: 
              username: "email@domain.com"
              id: 20
            date_assigned: "2024-10-23T16:09:36Z"
            date_resolved: "2025-01-15T07:37:54Z"
            events:
              assignment_id: 100
              actor: 50
              event_type: resolved
              datetime: "2025-01-15T07:37:54Z"
              context:
                entity_t_score: 100
                entity_c_score: 85
                to: 26
              outcome:
                id: 1
                builtin: true 
                user_selectable: true 
                title: "Benign True Positive"
                category: benign_true_positive
              resolved_by:
                id: 20
                username: "email@domain.com"
              triaged_detections: []
              host_id: 1
              account_id: null
              assigned_to:
                username: "email@domain.com"
                id: 20
        type: array
      previous_ips:
        description: Previously associated IP addresses. 
        items:
          type: string
          example: 101.101.101.101
          format: ipv4
        type: array
      privilege_category:
        description: A string to represent how privileged this host is, related
          to privilege level. Either Low (1-2), Medium (3-7), or High (8-10).
        type: string
        enum:
        - Low
        - Medium
        - High
        example: Low
      privilege_level:
        description: An integer from 1-10 to represent how privileged this host
          is. 
        type: integer
        example: 1
        minimum: 1
        maximum: 10
      probable_owner:
        description: User associated with host. 
        type: string
        example: "email@domain.com"
      sensor:
        description: Sensor associated with host. 
        type: string
        example: fLJrtq7u
      sensor_name:
        description: Name of the associated sensor. 
        type: string
        example: Vectra Z
      severity:
        description: Host severity, e.g., 'Low', 'Medium', 'High'. 
        type: string
        example: Low
        enum:
        - Low
        - Medium
        - High
      state:
        description: State of the host, e.g., 'active' or 'inactive'. 
        type: string
        example: active
        enum:
        - active
        - inactive
      t_score:
        description: Same as 'threat'. 
        type: integer
        example: 10
        minimum: 0
        maximum: 100
      tags:
        description: User-defined tags added to the host. 
        items:
          type: string
          example: Example tag
        type: array
      targets_key_asset:
        description: Whether host is targeting a key asset. 
        type: boolean
        example: false
      threat:
        description: The calculated threat level of the host. 
        type: integer
        example: 10
        minimum: 0
        maximum: 100
      url:
        description: The URL link directly to this host. 
        type: string
        example: "https://exampleurl.vectra.ai/api/v3.x/hosts/1"
    type: object
  HostSerializerV3_3:
    properties:
      active_traffic:
        description: Whether a host has active traffic. 
        type: boolean
        example: true
      assigned_date:
        description: Date when assignment was made. 
        format: date-time
        type: string
        example: '2025-03-06T15:46:38Z'
      assigned_to:
        description: Current user assigned to host. 
        type: string
        example: "email@domain.com"
      assignment:
        description: Assignment object associated with host. 
        $ref: '#/definitions/Assignment'
        example: 
          id: 100
          assigned_by: 
            username: "email@domain.com"
            id: 20
          date_assigned: "2024-10-23T16:09:36Z"
          date_resolved: null
          events:
            assignment_id: 100
            actor: 50
            event_type: created
            datetime: "2025-01-15T07:37:54Z"
            context:
              entity_t_score: 100
              entity_c_score: 85
              to: 26
            outcome: null
            resolved_by: null
            triaged_detections: []
            host_id: 1
            account_id: null
            assigned_to:
              username: "email@domain.com"
              id: 20
      c_score:
        description: Same as 'certainty'. 
        type: integer
        example: 30
        minimum: 0
        maximum: 100
      certainty:
        description: The calculated certainty of the host. 
        type: integer
        example: 30
        minimum: 0
        maximum: 100
      detection_profile:
        description: Associated detection profile. 
        type: string
        example: "Potentially Unwanted Program"
      detection_set:
        description: List of detection urls for this host. 
        items:
          type: string
          format: url
          example: "https://exampleurl.vectra.ai/api/v3.3/detections/1"
        type: array
      detection_summaries:
        description: List of detection summaries associated with the host. This is only included when 
          the param include_detection_summaries is set to true.
        type: array
        items: 
          $ref: '#/definitions/DetectionSummary'
          example: 
            detection_id: 1
            detection_url: "https://exampleurl.vectra.ai/api/v3.3/detections/1"
            detection_type: "Novel External Destination Port"
            detection_category: "INFO"
            is_targeting_key_asset: false
            state": "active"
            threat: 0
            certainty: 0
            is_triaged: false
            tags: []
            summary:
              target_domains: []
              dst_ips:
                - 100.100.100.100
              protocol_ports:
                - udp:8080
              description: "This host was seen making an outbound connection on a destination port that is rare for the environment and lasted longer than 5 minutes."
            assigned_to: null
            assigned_date: null
      groups:
        description: List of groups associated with the host. 
        items:
          $ref: '#/definitions/GroupDetections'
          example:
            id: 100
            name: Example host group
            description: Example description
            last_modified: "2024-01-23T21:22:49Z"
            last_modified_by: "email@domain.com"
            type: host
        type: array
      has_active_traffic:
        description: Whether a host has active traffic. 
        type: boolean
        example: true
      has_custom_model:
        description: Whether the host has a custom model. 
        type: boolean
        example: false
      host_artifact_set:
        description: A list of associated artifacts. 
        items:
          $ref: '#/definitions/HostArtifact'
        type: array
      host_luid:
        description: Luid associated with host. 
        type: string
        example: "KLOZdusj"
      host_session_luids:
        description: List of luids for corresponding host sessions. 
        items:
          type: string
          example: Bt972vKL
        type: array
      id:
        description: Host id.
        type: integer
        example: 1
        minimum: 1
      ip:
        description: IP address for the host. 
        type: string
        format: ipv4
        example: 100.100.100.100
      is_key_asset:
        description: Whether the host is a key asset. 
        type: boolean
        example: false
      is_targeting_key_asset:
        description: Whether the host is targeting a key asset. 
        type: boolean
        example: false
      key_asset:
        description: Whether the host is a key asset. 
        type: boolean
        example: false
      last_detection_timestamp:
        description: Last detection activity from this host.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      last_modified:
        description: Time the host was last modified. 
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      last_source:
        description: Last source IP associated with host. 
        type: string
        example: 100.100.100.100
      name:
        description: The name associated with the host.    
        type: string
        example: "jl-lopspec-12"
      note:
        description: Note attached to the host. 
        type: string
        example: Example note
      note_modified_by:
        description: Last user to modify note for host. 
        type: string
        example: "email@domain.com"
      note_modified_timestamp:
        description: Last time the note was modified.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      notes:
        description: A list of all notes on the host. List of Note objects.
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      past_assignments:
        description: List of past assignments. 
        items:
          $ref: '#/definitions/Assignment'
          example: 
            id: 100
            assigned_by: 
              username: "email@domain.com"
              id: 20
            date_assigned: "2024-10-23T16:09:36Z"
            date_resolved: "2025-01-15T07:37:54Z"
            events:
              assignment_id: 100
              actor: 50
              event_type: resolved
              datetime: "2025-01-15T07:37:54Z"
              context:
                entity_t_score: 100
                entity_c_score: 85
                to: 26
              outcome:
                id: 1
                builtin: true 
                user_selectable: true 
                title: "Benign True Positive"
                category: benign_true_positive
              resolved_by:
                id: 20
                username: "email@domain.com"
              triaged_detections: []
              host_id: 1
              account_id: null
              assigned_to:
                username: "email@domain.com"
                id: 20
        type: array
      previous_ips:
        description: Previously associated IP addresses. 
        items:
          type: string
          example: 101.101.101.101
          format: ipv4
        type: array
      privilege_category:
        description: A string to represent how privileged this host is, related
          to privilege level. Either Low (1-2), Medium (3-7), or High (8-10).
        type: string
        enum:
        - Low
        - Medium
        - High
        example: Low
      privilege_level:
        description: An integer from 1-10 to represent how privileged this host
          is. 
        type: integer
        example: 1
        minimum: 1
        maximum: 10
      probable_owner:
        description: User associated with host. 
        type: string
        example: "email@domain.com"
      sensor:
        description: Sensor associated with host. 
        type: string
        example: fLJrtq7u
      sensor_name:
        description: Name of the associated sensor. 
        type: string
        example: Vectra Z
      severity:
        description: Host severity, e.g., 'Low', 'Medium', 'High'. 
        type: string
        example: Low
        enum:
        - Low
        - Medium
        - High
      state:
        description: State of the host, e.g., 'active' or 'inactive'. 
        type: string
        example: active
        enum:
        - active
        - inactive
      t_score:
        description: Same as 'threat'. 
        type: integer
        example: 10
        minimum: 0
        maximum: 100
      tags:
        description: User-defined tags added to the host. 
        items:
          type: string
          example: Example tag
        type: array
      targets_key_asset:
        description: Whether host is targeting a key asset. 
        type: boolean
        example: false
      threat:
        description: The calculated threat level of the host. 
        type: integer
        example: 10
        minimum: 0
        maximum: 100
      url:
        description: The URL link directly to this host. 
        type: string
        example: "https://exampleurl.vectra.ai/api/v3.x/hosts/1"
    type: object
  LockdownSerializerV3_4:
    properties:
      entity_id:
        description: ID of related entity. 
        type: integer
        example: 1
        minimum: 1
      entity_name:
        description: Name of related entity. 
        type: string
        example: "jl-lopspec-12"
      id:
        description: Autoincrementing ID. 
        type: integer
        example: 1
        minimum: 1
      locked_by:
        description: User who issued the lockdown.
        type: string
        example: "email@domain.com"
      lock_event_timestamp:
        description: Time when lockdown occurred. 
        format: date-time
        type: string
        example: "2025-03-04T16:00:00Z"
      type:
        description: Type of related entity. 
        type: string
        example: host
      unlock_event_timestamp:
        description: Time when lockdown expires. 
        format: date-time
        type: string
        example: "2025-03-06T16:00:00Z"
    type: object
  LockdownSerializerV3_3:
    properties:
      entity_id:
        description: ID of related entity. 
        type: integer
        example: 1
        minimum: 1
      entity_name:
        description: Name of related entity. 
        type: string
        example: "jl-lopspec-12"
      entity_type:
        description: Type of related entity. 
        type: string
        example: host
      id:
        description: Autoincrementing ID. 
        type: integer
        example: 1
        minimum: 1
      locked_by:
        description: User who issued the lockdown. 
        type: string
        example: "email@domain.com"
      lock_event_timestamp:
        description: Time when lockdown occurred. 
        format: date-time
        type: string
        example: "2025-03-04T16:00:00Z"
      type:
        description: Type of related entity. 
        type: string
        example: host
      unlock_event_timestamp:
        description: Time when lockdown expires. 
        format: date-time
        type: string
        example: "2025-03-06T16:00:00Z"
    type: object
  MatchAlertStatsSerializerV3_3:
    title: Success
    type: object
    properties:
      alert_stats:
        description: List of json objects, each of which represents alert stats from
          a paired device with Match enabled.
        items:
          type: object
          properties:
            top_alert_counts:
              type: array
              items: 
                type: objects
                properties:
                  count:
                    type: integer
                    example: 101
                  signature_id: 
                    type: integer
                    example: 12
                  signature:
                    type: string
                    example: "GPL ATTACK_RESPONSE id check returned root"
            device_serial:
              type: string
              example: L839261748511729ceace80jh2g46f12ff
            eve_log_rotated_time:
              type: string
              format: date-time
        type: array
      details:
        description: Error output. Only present with an unsuccessful return code.
        type: string
        example: null
  MatchAssignmentSerializerV3_3:
    title: Success
    type: object
    properties:
      details:
        description: Error output. Only present with an unsuccessful return code.
        type: string
      device_to_rules_map:
        description: List of objects, each of which represents a device, providing
          information about which ruleset is being run on that device, who updated
          it, and when it was last updated. 
        items:
          type: object
          properties:
            device_serial:
              type: string
              example: L839261748511729ceace80jh2g46f12ff
            rules:
              type: array
              items:
                type: string
                example: "8cc9a23f-76e4-3035-8h5f-d4728d8g3h76"
            updated_by:
              type: string
              example: "email@domain.com"
            timestamp:
              type: string
              format: date-time
        type: array
      rules_to_devices_map:
        description: List of objects, each of which represents a rules file, providing
          information about which devices that ruleset is being run on, and other
          metadata about the file 
        items:
          type: object
          properties:
            uuid:
              type: string
              example: "8cc9a23f-76e4-3035-8h5f-d4728d8g3h76"
            name:
              type: string
              example: new_8_13_2023.rules
            device_serials:
              type: array
              items:
                type: string
                example: L839261748511729ceace80jh2g46f12ff
            notes:
              type: object
              properties:
                creator:
                  type: string
                  example: vectra
                description:
                  type: string
                  example: Example description
            hashsum:
              type: string
              example: f5a5fd42d16a20302798ef6ed309979b431a4a57f5a50090f1f6c4b0dff5a3b4
            timestamp:
              type: string
              format: date-time
        type: array
  MatchAvailableDevicesSerializerV3_3:
    title: 'Success'
    type: object
    properties:
      details:
        description: Error output. Only present with an unsuccessful return code.
        type: string
        example: null
      devices:
        description: List of json objects, each of which represents information about
          a paired device.
        items:
          type: object
          properties:
            alias:
              type: string
              example: Example sensor
            location:
              type: string
              example: PDXk
            device_serial:
              type: string
              example: L839261748511729ceace80jh2g46f12ff
            ip_address:
              type: string
              example: 100.100.100.100
            headend_uri:
              type: string
              example: 100.100.100.100
            last_seen:
              type: string
              format: date-time
            product_name:
              type: string
              example: vSensor
            is_virtual:
              type: boolean
              example: true 
            version:
              type: string
              example: 6.9.3-4-32
            mode:
              type: string
              example: sensor
        type: array
  MatchEnablementSerializerV3_3:
    type: object
    title: 'Success'
    properties:
      details:
        description: Error output. Only present with an unsuccessful return code.
        type: string
        example: null
      is_enabled:
        description: Whether Vectra Match is enabled on the requested paired device
        type: boolean
        example: true
  MatchRulesSerializerV3_3:
    type: object
    title: 'Success'
    properties:
      details:
        description: Error output. Only present with an unsuccessful return code.
        type: string
        example: null
      device_serials:
        description: List of all device serials on which the ruleset is currently
          running.
        items:
          type: string
          example: L839261748511729ceace80jh2g46f12ff
        type: array
      hashsum:
        description: sha256 sum of file.
        type: string
        example: f5a5fd42d16a20302798ef6ed309979b431a4a57f5a50090f1f6c4b0dff5a3b4
      name:
        description: Display name of file. 
        type: string
        example: new_8_13_2023.rules 
      notes:
        description: Notes about a file.
        type: object
        properties:
          creator:
            type: string
            example: vectra
          description:
            type: string
            example: Example description
      timestamp:
        description: Time of file upload. 
        format: date-time
        title: Notes
        type: string
      uuid:
        description: UUID of file. 
        type: string
        example: "8cc9a23f-76e4-3035-8h5f-d4728d8g3h76"
  MatchStatsSerializerV3_3:
    type: object
    title: Success
    properties:
      details:
        description: Error output. Only present with an unsuccessful return code.
        type: string
      stats:
        description: List of json objects, each of which represents stats from a paired
          device with Match enabled.
        items:
          type: object
          example:
            eve_stats:
              timestamp: '2025-02-24T23:57:56.893778+0000'
              event_type: stats
              stats:
                uptime: 386
                capture:
                  packets: 0
                  rx_errors: 0
                  tx_errors: 0
                  dpdk:
                    imissed: 0
                    no_mbufs: 0
                    ierrors: 0
                decoder:
                  pkts: 0
                  bytes: 0
                  invalid: 0
                  ipv4: 0
                  ipv6: 0
                  ethernet: 0
                  chdlc: 0
                  raw: 0
                  'null': 0
                  sll: 0
                  tcp: 0
                  udp: 0
                  sctp: 0
                  esp: 0
                  icmpv4: 0
                  icmpv6: 0
                  ppp: 0
                  pppoe: 0
                  geneve: 0
                  gre: 0
                  vlan: 0
                  vlan_qinq: 0
                  vxlan: 0
                  vntag: 0
                  ieee8021ah: 0
                  teredo: 0
                  ipv4_in_ipv6: 0
                  ipv6_in_ipv6: 0
                  mpls: 0
                  avg_pkt_size: 0
                  max_pkt_size: 0
                  max_mac_addrs_src: 0
                  max_mac_addrs_dst: 0
                  erspan: 0
                  nsh: 0
                  event:
                    ipv4:
                      pkt_too_small: 0
                      hlen_too_small: 0
                      iplen_smaller_than_hlen: 0
                      trunc_pkt: 0
                      opt_invalid: 0
                      opt_invalid_len: 0
                      opt_malformed: 0
                      opt_pad_required: 0
                      opt_eol_required: 0
                      opt_duplicate: 0
                      opt_unknown: 0
                      wrong_ip_version: 0
                      icmpv6: 0
                      frag_pkt_too_large: 0
                      frag_overlap: 0
                      frag_ignored: 0
                    icmpv4:
                      pkt_too_small: 0
                      unknown_type: 0
                      unknown_code: 0
                      ipv4_trunc_pkt: 0
                      ipv4_unknown_ver: 0
                    icmpv6:
                      unknown_type: 0
                      unknown_code: 0
                      pkt_too_small: 0
                      ipv6_unknown_version: 0
                      ipv6_trunc_pkt: 0
                      mld_message_with_invalid_hl: 0
                      unassigned_type: 0
                      experimentation_type: 0
                    ipv6:
                      pkt_too_small: 0
                      trunc_pkt: 0
                      trunc_exthdr: 0
                      exthdr_dupl_fh: 0
                      exthdr_useless_fh: 0
                      exthdr_dupl_rh: 0
                      exthdr_dupl_hh: 0
                      exthdr_dupl_dh: 0
                      exthdr_dupl_ah: 0
                      exthdr_dupl_eh: 0
                      exthdr_invalid_optlen: 0
                      wrong_ip_version: 0
                      exthdr_ah_res_not_null: 0
                      hopopts_unknown_opt: 0
                      hopopts_only_padding: 0
                      dstopts_unknown_opt: 0
                      dstopts_only_padding: 0
                      rh_type_0: 0
                      zero_len_padn: 0
                      fh_non_zero_reserved_field: 0
                      data_after_none_header: 0
                      unknown_next_header: 0
                      icmpv4: 0
                      frag_pkt_too_large: 0
                      frag_overlap: 0
                      frag_invalid_length: 0
                      frag_ignored: 0
                      ipv4_in_ipv6_too_small: 0
                      ipv4_in_ipv6_wrong_version: 0
                      ipv6_in_ipv6_too_small: 0
                      ipv6_in_ipv6_wrong_version: 0
                    tcp:
                      pkt_too_small: 0
                      hlen_too_small: 0
                      invalid_optlen: 0
                      opt_invalid_len: 0
                      opt_duplicate: 0
                    udp:
                      pkt_too_small: 0
                      hlen_too_small: 0
                      hlen_invalid: 0
                    sll:
                      pkt_too_small: 0
                    ethernet:
                      pkt_too_small: 0
                    ppp:
                      pkt_too_small: 0
                      vju_pkt_too_small: 0
                      ip4_pkt_too_small: 0
                      ip6_pkt_too_small: 0
                      wrong_type: 0
                      unsup_proto: 0
                    pppoe:
                      pkt_too_small: 0
                      wrong_code: 0
                      malformed_tags: 0
                    gre:
                      pkt_too_small: 0
                      wrong_version: 0
                      version0_recur: 0
                      version0_flags: 0
                      version0_hdr_too_big: 0
                      version0_malformed_sre_hdr: 0
                      version1_chksum: 0
                      version1_route: 0
                      version1_ssr: 0
                      version1_recur: 0
                      version1_flags: 0
                      version1_no_key: 0
                      version1_wrong_protocol: 0
                      version1_malformed_sre_hdr: 0
                      version1_hdr_too_big: 0
                    vlan:
                      header_too_small: 0
                      unknown_type: 0
                      too_many_layers: 0
                    ieee8021ah:
                      header_too_small: 0
                    vntag:
                      header_too_small: 0
                      unknown_type: 0
                    ipraw:
                      invalid_ip_version: 0
                    ltnull:
                      pkt_too_small: 0
                      unsupported_type: 0
                    sctp:
                      pkt_too_small: 0
                    esp:
                      pkt_too_small: 0
                    mpls:
                      header_too_small: 0
                      pkt_too_small: 0
                      bad_label_router_alert: 0
                      bad_label_implicit_null: 0
                      bad_label_reserved: 0
                      unknown_payload_type: 0
                    vxlan:
                      unknown_payload_type: 0
                    geneve:
                      unknown_payload_type: 0
                    erspan:
                      header_too_small: 0
                      unsupported_version: 0
                      too_many_vlan_layers: 0
                    dce:
                      pkt_too_small: 0
                    chdlc:
                      pkt_too_small: 0
                    nsh:
                      header_too_small: 0
                      unsupported_version: 0
                      bad_header_length: 0
                      reserved_type: 0
                      unsupported_type: 0
                      unknown_payload: 0
                  too_many_layers: 0
                flow:
                  memcap: 0
                  total: 0
                  active: 0
                  tcp: 0
                  udp: 0
                  icmpv4: 0
                  icmpv6: 0
                  tcp_reuse: 0
                  get_used: 0
                  get_used_eval: 0
                  get_used_eval_reject: 0
                  get_used_eval_busy: 0
                  get_used_failed: 0
                  wrk:
                    spare_sync_avg: 0
                    spare_sync: 0
                    spare_sync_incomplete: 0
                    spare_sync_empty: 0
                    flows_evicted_needs_work: 0
                    flows_evicted_pkt_inject: 0
                    flows_evicted: 0
                    flows_injected: 0
                    flows_injected_max: 0
                  end:
                    state:
                      new: 0
                      established: 0
                      closed: 0
                      local_bypassed: 0
                    tcp_state:
                      none: 0
                      syn_sent: 0
                      syn_recv: 0
                      established: 0
                      fin_wait1: 0
                      fin_wait2: 0
                      time_wait: 0
                      last_ack: 0
                      close_wait: 0
                      closing: 0
                      closed: 0
                    tcp_liberal: 0
                  mgr:
                    full_hash_pass: 0
                    rows_per_sec: 6553
                    rows_maxlen: 0
                    flows_checked: 0
                    flows_notimeout: 0
                    flows_timeout: 0
                    flows_timeout_inuse: 0
                    flows_evicted: 0
                    flows_evicted_needs_work: 0
                  spare: 10000
                  emerg_mode_entered: 0
                  emerg_mode_over: 0
                  recycler:
                    recycled: 0
                    queue_avg: 0
                    queue_max: 0
                  memuse: 7394304
                tcp:
                  active_sessions: 0
                  sessions: 0
                  ssn_memcap_drop: 0
                  ssn_from_cache: 0
                  ssn_from_pool: 0
                  pseudo: 0
                  pseudo_failed: 0
                  invalid_checksum: 0
                  no_flow: 0
                  syn: 0
                  synack: 0
                  rst: 0
                  midstream_pickups: 0
                  pkt_on_wrong_thread: 0
                  segment_memcap_drop: 0
                  segment_from_cache: 0
                  segment_from_pool: 0
                  stream_depth_reached: 0
                  reassembly_gap: 0
                  overlap: 0
                  overlap_diff_data: 0
                  insert_data_normal_fail: 0
                  insert_data_overlap_fail: 0
                  memuse: 606208
                  reassembly_memuse: 114688
                defrag:
                  ipv4:
                    fragments: 0
                    reassembled: 0
                    timeouts: 0
                  ipv6:
                    fragments: 0
                    reassembled: 0
                    timeouts: 0
                  max_frag_hits: 0
                flow_bypassed:
                  local_pkts: 0
                  local_bytes: 0
                  local_capture_pkts: 0
                  local_capture_bytes: 0
                  closed: 0
                  pkts: 0
                  bytes: 0
                detect:
                  engines:
                    type: array
                    items:
                      id: 0
                      last_reload: '2025-02-24T23:57:53.549461+0000'
                      rules_loaded: 61258
                      rules_failed: 0
                  alert: 0
                  alert_queue_overflow: 0
                  alerts_suppressed: 0
                app_layer:
                  flow:
                    http: 0
                    ftp: 0
                    smtp: 0
                    tls: 0
                    ssh: 0
                    imap: 0
                    smb: 0
                    dcerpc_tcp: 0
                    dns_tcp: 0
                    nfs_tcp: 0
                    ntp: 0
                    ftp-data: 0
                    tftp: 0
                    ike: 0
                    krb5_tcp: 0
                    quic: 0
                    dhcp: 0
                    snmp: 0
                    sip: 0
                    rfb: 0
                    mqtt: 0
                    telnet: 0
                    rdp: 0
                    http2: 0
                    failed_tcp: 0
                    dcerpc_udp: 0
                    dns_udp: 0
                    nfs_udp: 0
                    krb5_udp: 0
                    failed_udp: 0
                  tx:
                    http: 0
                    ftp: 0
                    smtp: 0
                    tls: 0
                    ssh: 0
                    imap: 0
                    smb: 0
                    dcerpc_tcp: 0
                    dns_tcp: 0
                    nfs_tcp: 0
                    ntp: 0
                    ftp-data: 0
                    tftp: 0
                    ike: 0
                    krb5_tcp: 0
                    quic: 0
                    dhcp: 0
                    snmp: 0
                    sip: 0
                    rfb: 0
                    mqtt: 0
                    telnet: 0
                    rdp: 0
                    http2: 0
                    dcerpc_udp: 0
                    dns_udp: 0
                    nfs_udp: 0
                    krb5_udp: 0
                  error:
                    http:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    ftp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    smtp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    tls:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    ssh:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    imap:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    smb:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    dcerpc_tcp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    dns_tcp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    nfs_tcp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    ntp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    ftp-data:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    tftp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    ike:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    krb5_tcp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    quic:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    dhcp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    snmp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    sip:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    rfb:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    mqtt:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    telnet:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    rdp:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    http2:
                      gap: 0
                      alloc: 0
                      parser: 0
                      internal: 0
                    failed_tcp:
                      gap: 0
                    dcerpc_udp:
                      alloc: 0
                      parser: 0
                      internal: 0
                    dns_udp:
                      alloc: 0
                      parser: 0
                      internal: 0
                    nfs_udp:
                      alloc: 0
                      parser: 0
                      internal: 0
                    krb5_udp:
                      alloc: 0
                      parser: 0
                      internal: 0
                  expectations: 0
                http:
                  memuse: 0
                  memcap: 0
                ftp:
                  memuse: 0
                  memcap: 0
                file_store:
                  open_files: 0
            ft_stats:
              memif_bytes_dropped: 9693769206
              memif_bytes_sent: 9052976
              memif_packets_dropped: 12256823
              memif_packets_sent: 8131
              packets_received: 12264954
              bytes_received: 9702822182
            interface_stats:
              interfaces:
                type: array
                items:
                  byte_dropped: 0
                  byte_received: 9702822182
                  byte_received_perf: 0
                  ierrors: 0
                  imissed: 7285
                  ipackets: 12264954
                  mbuf_9k_alloc_failed: 0
                  mbuf_9k_alloc_ok: 0
                  mbuf_9k_populate_failed: 0
                  name: eth0
                  no_packet: 4638591680
                  packet_dropped: 0
                  packet_received: 12264954
                  packet_received_perf: 0
                  queues:
                    type: array
                    items:
                      q_errors: 0
                      q_ibytes: 9702822182
                      q_idx: 0
                      q_ipackets: 12264954
                      q_rx_desc: 1024
                  rx_loop: 4644962817
                  rx_nombuf: 0
                  speed: 10000
                  status: up
                  tx_attempt: 0
                  tx_loop: 0
                  tx_packet_dropped: 0
                  type: dpdk
            forwarder_stats:
              events_processed: 0
              events_sent: 0
              alerts_dropped_for_rate_limit: 0
              alerts_dropped_for_rate_limit_this_hour: 0
            device_serial: L839261748511729ceace80jh2g46f12ff
            timestamp: "2025-02-25T00:55:46.251Z"
        type: array
  MatchStatusSerializerV3_3:
    type: object
    title: 'Success'
    properties:
      details:
        description: Error output. Only present with an unsuccessful return code.
        type: string
        example: null
      status:
        description: List of json objects, each of which represents status of a paired
          device with Match enabled.
        items:
          type: object
          properties:
            is_enabled:
              type: boolean
              example: true
            process_health:
              type: string
              example: healthy
            device_serial:
              type: string
              example: L839261748511729ceace80jh2g46f12ff
            timestamp:
              type: string
              format: date-time
            process_error_detail:
              type: string
        type: array
  NoteSerializerV2_2:
    properties:
      created_by:
        description: User who created the note.
        type: string
        example: "email@domain.com"
      date_created:
        description: Time when the note was created.
        format: date-time
        type: string
        example: '2025-01-08T18:07:35.127977+00:00'
      date_modified:
        description: Time when the note was last modified.
        format: date-time
        type: string
        example: '2025-01-08T18:07:35.127977+00:00'
      id:
        description: Auto-incrementing table id. 
        type: integer
        example: 1
      modified_by:
        description: Last user who modified the note.
        type: string
        example: "email@domain.com"
      note:
        description: Content of the note.
        type: string
        example: Example Note
    type: object
  RuleRequestBodyV3:
    type: object
    properties:
      description:
        type: string
        description: A description of the Triage rule. 
        example: Example description
      detection_category:
        type: string
        description: The original detection category. 
        example: "COMMAND & CONTROL"
      triage_category:
        type: string
        description: Custom Triage label used to categorize specified detections. 
        example: Benign Detection
      detection:
        type: string
        description: The original detection type. 
        example: "Peer-to-Peer"
      is_whitelist:
        type: boolean
        description: Flag whether the triage rule whitelists all detections for this
          activity. 
        example: false
      source_conditions:
        type: object
        x-nullable: true
        description: |
          Specifies the entity this Triage rule applies to.
          Here 'source_conditions' represents the conditions that can be applied to
          the source of a detection, including host, account, IP, and sensor.  
        example:
          OR:
            - AND:
              - ANY_OF:
                  label: "IP"
                  field: "ip"
                  values:
                  - value: "1.2.3.5"
                    label: "1.2.3.5"
                    url: null
                  groups: []
      additional_conditions:
        type: object
        description: |
          Specifies additional matching criteria for this Triage rule.
          Here 'additional_conditions' are other conditions that are different on a
          per-detection-type basis. 
        x-nullable: true
        example:
          OR:
            - AND:
              - ANY_OF:
                  label: "Domain"
                  field: "remote1_dns"
                  values:
                  - value: "test.com"
                    label: "test.com"
                    url: null
                  groups: []
  RuleSerializerV3:
    type: object
    properties:
      id:
        type: integer
        description: The ID of the Triage Rule.
        example: 1
      description:
        type: string
        description: A description of the Triage Rule. 
        example: Example description
      url:
        type: string
        description: A URL to the Triage Rule. 
        example: "https://exampleurl.vectra.ai/api/v3/rules/1"
      enabled:
        type: boolean
        description: Describes if the Triage Rule is enabled.
        example: true
      created_timestamp:
        type: string
        format: date-time
        description: The time the Triage Rule was created. 
      last_timestamp:
        type: string
        format: date-time
        description: The time when the Triage filter was triggered.
      is_whitelist:
        type: boolean
        description: Flag whether the triage rule whitelists all detections for this
          activity. 
        example: false
      priority:
        type: integer
        description: Value used in ordering execution of Triage filters. 
        example: 1
      active_detections:
        type: integer
        description: The total number of active detections this Triage Rule applies to. 
        example: 1
      total_detections:
        type: integer
        description: The total number of active detections (active or inactive) this
          Triage rule applies to. 
        example: 1
      detection_category:
        type: string
        description: The original detection category. 
        example: "COMMAND & CONTROL"
      triage_category:
        type: string
        description: Custom Triage label used to categorize specified detections. 
        example: Benign Detection
      template:
        type: boolean
        description: Specifies if this Triage rule was created based off of a template.
        example: false
      detection:
        type: string
        description: The original detection type. 
        example: "Peer-to-Peer"
      source_conditions:
        type: object
        x-nullable: true
        description: |
          Specifies the entity this Triage rule applies to.
          Here 'source_conditions' represents the conditions that can be applied to
          the source of a detection, including host, account, IP, and sensor.
        example:
          OR:
            - AND:
              - ANY_OF:
                  label: "IP"
                  field: "ip"
                  values:
                  - value: "1.2.3.5"
                    label: "1.2.3.5"
                    url: null
                  groups: []
      additional_conditions:
        type: object
        x-nullable: true
        description: |
          Specifies additional matching criteria for this Triage rule.
          Here 'additional_conditions' are other conditions that are different on a
          per-detection-type basis. 
        example:
          OR:
            - AND:
              - ANY_OF:
                  label: "Domain"
                  field: "remote1_dns"
                  values:
                  - value: "test.com"
                    label: "test.com"
                    url: null
                  groups: []
  TaggingSerializerV3:
    type: object
    properties:
      status:
        description: Operation status.
        type: string
        example: success
      tag_id:
        type: integer
        description: Tag id.
        example: 1
      tags:
        description: Entity tags.
        type: array
        items:
          type: string
          example: Example tag
  ThreatFeedSerializerV3_3:
    type: object
    properties:
      id:
        type: string
        description: The ID of the threat feed. 
        example: l976d910477kok37190de4d01937d623
      _rev:
        type: string
        description: The revision ID of the threat feed. 
        example: 22-h2t1e5e2f4j82904wweb6362bc06ddtc
      name:
        type: string
        description: The name of the threat feed. 
        example: Vectra - Example Feed
      lastUpdatedBy:
        type: string
        description: The user who updated the threat feed. 
        example: api_client_b24d73819eed55528efee804f2024371
      version:
        type: string
        description: The version of the threat feed. 
        example: "6.7.0-7-12"
      uploadDate:
        type: string
        description: The creation date of the threat feed. 
        format: date-time
      lastUpdated:
        type: string
        description: The last update date of the threat feed. 
        format: date-time
      defaults:
        type: object
        description: Dictionary describing threat feed default
          values. 
        example:
          indicatorType: Watchlist
          certainty: High
          duration: 90
          category: lateral
      uploadResults:
        type: object
        description: Dictionary describing the file uploaded 
        example:
          indicatorType: Watchlist
          observableCount: 3
          certainty: High
          expiration: '2025-01-08T18:07:35.127977+00:00'
          category: lateral
      type:
        type: string
        description: Threat Feed 
        example: STIX
  UniqueHostAuditSerializerV3_3:
    type: object
    properties:
      host_id:
        title: host id
        type: integer
        description: Related host ID. 
        example: 1
      host_luid:
        title: host luid
        type: string
        description: Related host LUID. 
        example: "KLOZdusj"
      ip_address:
        title: Ip address
        type: string
        description: Related host IP address. 
        example: 100.100.100.100
        format: ipv4
      host_artifact_value:
        title: host artifact value
        type: string
        description: Host artifact value (if available). 
        example: VHE9102t9c9g82a91026yu5d71b9102f89z
      host_artifact_type:
        title: Host artifact type
        type: string
        description: Host artifact type (if available). 
        example: dhcp
      month:
        title: Month
        type: string
        format: date-time
        description: Formatted as 'YYYY-MM'
        example: "2024-03"
      last_seen_start:
        title: Last seen start
        type: string
        format: date-time
        description:
          Last seen start.  The column is 'last_seen' because it gets updated at
          new host sessions are created. Host may have been seen at more times
          than what is recorded 
      last_seen_end:
        title: Last seen end
        type: string
        format: date-time
        description:
          Last seen end.  The column is 'last_seen' because it gets updated at
          new host sessions are created. Host may have been seen at more times
          than what is recorded 
  UserSerializerV3_3:
    properties:
      email:
        description: The email associated with the user.
        type: string
        example: "email@domain.com"
      id:
        description: The ID of the user. 
        type: integer
        example: 1
        minimum: 1
      last_login:
        description: Last login timestamp for the user.
        format: date-time
        type: string
        example: "2025-03-06T16:00:00Z"
      last_login_timestamp:
        description: Last login timestamp for the user.
        format: date-time
        type: string
        example: "2025-03-06T16:00:00Z"
      role:
        description: The role associated with the user.
        type: string
        example: Super Admin
      username:
        description: Username of the user.
        type: string
        example: "email@domain.com"
    type: object
  AccountSerializerV3_3:
    properties:
      account_type:
        description: The method through which this account was discovered. Can be
          one or more of the listed options.
        type: array
        items:
          example: o365
          type: string
          enum:
          - entra_principal
          - o365
          - aws
          - kerberos
      assignment:
        description: Information about the assignment associated with the account.
        $ref: "#/definitions/Assignment"
      associated_accounts:
        description: A list of associated accounts.
        type: array
        items:
          type: string
          example: "O365:email@domain.com"
      certainty:
        description: The certainty score attributed to the account. 
        type: integer
        example: 20
        minimum: 0
        maximum: 100
      data_source:
        description: Information about the data source. Includes type, connection
          name, and connection ID.
        $ref: "#/definitions/DataSource"
      detection_set:
        description: List of detections for account. 
        items:
          format: uri
          type: string
          example: "https://exampleurl.vectra.ai/api/v3/detections/1"
        type: array
      detection_summaries:
        description: List of detection summaries for the account. 
        items:
          $ref: '#/definitions/DetectionSummary'
        type: array
      id:
        description: The ID of the account.
        type: integer
        example: 1
        minimum: 1
      last_detection_timestamp:
        description: Timestamp of the last detection activity from this account.
        type: string
        example: '2025-03-03T10:46:38Z'
      name:
        description: The name associated with the account.
        type: string
        example: "O365:email@domain.com"
      note:
        description: User-defined note added to the account.
        type: string
        example: 'Example note.'
      note_modified_by:
        description: Username who last modified the note.
        type: string
        example: "email@domain.com"
      note_modified_timestamp:
        description: Timestamp when the note was last modified.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      notes:
        description: An array of all notes on the account. Includes id, date_created,
          date_modified, created_by, modified_by, and note contents. 
          objects
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      past_assignments:
        description: List of past assignments associated with the account.
        type: array
        items:
          $ref: "#/definitions/Assignment"
      privilege_category:
        description: A string to represent how privileged this account is. Either
          'Low', 'Medium', or 'High'.
        type: string
        enum:
        - Low
        - Medium
        - High
        example: Low
      privilege_level:
        description: A number 1-10 to represent how privileged this account is.
        type: integer
        example: 2
        minimum: 1
        maximum: 10
      probable_home:
        description: Name of the probable home of the account. 
        type: string
        example: ad.example.com
      sensors:
        description: List of sensors associated with the account. 
        type: array
        items:
          type: string
          example: lq6fk8hc
      severity:
        description: The severity of this account. Either 'Low', 'Medium', 'High',
          or 'Critical'. Calculated based on the threat and certainty of the account.
        type: string
        enum:
        - Low
        - Medium
        - High
        - Critical
        example: Low
      state:
        description: The state of the account.
        type: string
        enum:
        - active
        - inactive
        example: active
      subaccounts:
        description: |
          A list of associated accounts. To be deprectaed in future versions in
          favor for associated_accounts.
        type: array
        items:
          type: string
          example: "O365:email@domain.com"
      tags:
        description: User-defined tags added to the account. 
        type: array
        items:
          type: string
          example: example tag
      threat:
        description: The threat score attributed to the account. 
        type: integer
        example: 3
        minimum: 0
        maximum: 100
      url:
        description: A v3.0 URL to the account. Useful when using a web-based REST
          API browser. 
        format: url
        type: string
        example: "https://exampleurl.vectra.ai/api/v3.3/accounts/1"
    type: object
  UserSerializerV3_4:
    properties:
      email:
        description: The email associated with the user.
        type: string
        example: "email@domain.com"
      id:
        description: The ID of the user.
        type: integer
        example: 1
        minimum: 1
      identities:
        description: The identities for the user's login profiles (local and/or SAML). 
        type: array
        example:
          - type: "SAML"
            saml_profile_id: 1
          - type: "LOCAL"
        items:
          oneOf:
            - type: object
              title: SAML identity object
              properties:
                type:
                  type: string
                  enum:
                    - SAML
                  example: SAML
                saml_profile_id:
                  type: integer 
                  minimum: 1
                  example: 1
            - type: object
              title: Local identity object
              properties:
                type:
                  type: string
                  enum:
                    - LOCAL
                  example: LOCAL
      name:
        description: The user's first and last name.
        type: string
        example: John Doe
      last_login_timestamp:
        description: Last login timestamp for the user.
        format: date-time
        type: string
        example: "2025-03-06T16:00:00Z" 
      role:
        description: The role associated with the user.
        type: string
        example: super_admins
      verified:
        description: The verification status of the user. Flags if the user has signed in.
        type: boolean
        example: true
    type: object
  UserRoleSerializerV3_4:
    properties:
      id:
        description: The ID of the role.
        type: integer
        example: 1
        minimum: 1
      name:
        description: The role display name.
        type: string
        example: Restricted Admin
      standardized_name:
        description: The snake-cased standardized name of the role.
        type: string
        example: restricted_admins
    type: object
  AccountSerializerV3_4:
    properties:
      account_type:
        description: The method through which this account was discovered. Can be
          one or more of the listed options.
        type: array
        items:
          example: o365
          type: string
          enum:
          - entra_principal
          - o365
          - aws
          - kerberos
      assignment:
        description: Information about the assignment associated with the account.
        $ref: "#/definitions/Assignment"
      associated_accounts:
        description: A list of associated accounts.
        type: array
        items:
          type: string
          example: "O365:email@domain.com"
      certainty:
        description: The certainty score attributed to the account. 
        type: integer
        example: 20
        minimum: 0
        maximum: 100
      data_source:
        description: Information about the data source. Includes type, connection
          name, and connection ID.
        $ref: "#/definitions/DataSource"
      detection_set:
        description: List of detections for account. 
        items:
          format: uri
          type: string
          example: "https://exampleurl.vectra.ai/api/v3/detections/1"
        type: array
      detection_summaries:
        description: List of detection summaries for the account. 
        items:
          $ref: '#/definitions/DetectionSummary'
        type: array
      id:
        description: The ID of the account.
        type: integer
        example: 1
        minimum: 1
      last_detection_timestamp:
        description: Timestamp of the last detection activity from this account.
        type: string
        example: '2025-03-03T10:46:38Z'
      name:
        description: The name associated with the account.
        type: string
        example: "O365:email@domain.com"
      note:
        description: User-defined note added to the account.
        type: string
        example: 'Example note.'
      note_modified_by:
        description: Username who last modified the note.
        type: string
        example: "email@domain.com"
      note_modified_timestamp:
        description: Timestamp when the note was last modified.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      notes:
        description: A list of the ten most recent notes on the account. The first note will be truncated to 1000 characters and following notes truncated to 100 characters. 
        items:
          $ref: '#/definitions/NoteSerializerV2_2'
        type: array
      past_assignments:
        description: List of past assignments associated with the account.
        type: array
        items:
          $ref: "#/definitions/Assignment"
      privilege_category:
        description: A string to represent how privileged this account is. Either
          'Low', 'Medium', or 'High'.
        type: string
        enum:
        - Low
        - Medium
        - High
        example: Low
      privilege_level:
        description: A number 1-10 to represent how privileged this account is.
        type: integer
        example: 2
        minimum: 1
        maximum: 10
      probable_home:
        description: Name of the probable home of the account. 
        type: string
        example: ad.example.com
      sensors:
        description: List of sensors associated with the account. 
        type: array
        items:
          type: string
          example: lq6fk8hc
      severity:
        description: The severity of this account. Either 'Low', 'Medium', 'High',
          or 'Critical'. Calculated based on the threat and certainty of the account.
        type: string
        enum:
        - Low
        - Medium
        - High
        - Critical
        example: Low
      state:
        description: The state of the account.
        type: string
        enum:
        - active
        - inactive
        example: active
      tags:
        description: User-defined tags added to the account. 
        type: array
        items:
          type: string
          example: example tag
      threat:
        description: The threat score attributed to the account. 
        type: integer
        example: 3
        minimum: 0
        maximum: 100
      url:
        description: A v3.0 URL to the account. Useful when using a web-based REST
          API browser. 
        format: url
        type: string
        example: "https://exampleurl.vectra.ai/api/v3.4/accounts/1"
    type: object
  DataSourceConnectorSerializerV3_4:
    properties:
      connector_id:
        description: The unique identifier of the connector.
        type: string
        example: "263d6625-23ac-4453-ba3f-5b87e9bae242"
      connector_name:
        description: The name of the connector.
        type: string
        example: "AWS CloudTrail Connector"
      connector_type:
        description: The type of the connector.
        type: string
        enum:
        - aws
        - o365
        - azure-cp
        example: aws
      connector_state:
        description: The current state of the connector.
        type: string
        enum:
        - setup
        - connecting
        - connected
        - error
        example: connected
      region:
        description: AWS region SaaSUI tenant is deployed.
        type: string
        example: "us-west-2"
      created_at:
        description: The timestamp when the connector was created.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      error:
        description: Error message if the connector is in error state.
        type: string
        x-nullable: true
        example: null
      updated_at:
        description: The timestamp when the connector was last updated.
        format: date-time
        type: string
        example: '2025-03-03T10:46:38Z'
      properties:
        description: Connector-specific properties and configuration data.
        type: object
        example:
          aws:
            {
              "aws_account_id": "123456789012",
              "cloudformation_url": "https://console.aws.amazon.com/cloudformation/home",
              "cloud_trail_s3_bucket_name": "my-cloudtrail-bucket",
              "external_id": "b94c021e-8ffc-4420-9f66-909360bd6d83",
              "sns_topic_for_S3_events_arn": "sample-arn:aws:sns:region:0123456789:SampleSNSName-Kd7XEA7ggv3U",
              "vectra-account-id": "9876543210",
              "vectra-iam-role": "sample-arn:aws:iam::98765643210:role/sampleRole",
              "last_log_received": "2025-07-01T12:00:00.725Z",
              "filters": [ ]
            }
          o365:
            {
              "setup_link": "https://sample-consent-o365.example.com",
              "license_type": "premium",
              "api_type": "standard",
              "ms_tenant_id": "a7c2aeb3-a979-4da3-a496-eac5c26eb9a1",
              "audit_logs_enabled": true,
              "last_log_received": "2025-07-02T12:00:00.725Z"
            }
          azure-cp:
            {
              "setup_link": "https://sample-consent-azure.example.com",
              "ms_tenant_id": "b883b1d8-d1f8-4f2d-8fd1-539b0e807794",
              "resource_group_id": "/sample/1d4d85ce-48b1-43f8-ad79-f0c40b9989e2/sampleResourceGroups/sample-cdr",
              last_log_received": "2025-07-04T12:00:00.725Z",
            }
    type: object
  VectraMatchRuleUploadV3_3:
    properties:
      id:
        description: UUID for file upload.
        type: string
        example: "r90f41hj-1092-1290-5t36-1ka0w901ct8q"
      upload_status:
        description: Upload status. 
        type: string
        enum:
        - completed
        - aborted
        - pending
        example: completed
      external_task_status:
        description: Status of sync to appliance. 
        title: Appliance Sync Status
        type: string
        example: not_started
        enum:
        - success
        - failed
        - not_started
        - in_progress
      external_task_error:
        description: Error details if syncing to the appliance fails
        title: Sync and Validation Error details
        type: string
        x-nullable: true
        example: "Uploaded Vectra Match ruleset failed validation"
      external_task_error_code:
        description: A numeric code for syncing and validation errors occuring during appliance syncing.
        type: integer
        example: 6005
        x-nullable: true
      external_task_updated_at:
        description: Time when sync status was last updated. 
        format: date-time
        title: Appliance Sync Status Updated At
        type: string
    type: object
  VectraMatchRulesUploadV3_3:
    properties:
      id:
        description: UUID for file upload.
        type: string
        example: "r90f41hj-1092-1290-5t36-1ka0w901ct8q"
      file_name:
        description: File name.
        type: string
        example: "example_filename"
      notes: 
        description: Associated notes. 
        type: string
        example: "Example note"
      upload_status:
        description: The rule upload status. 
        type: string
        example: completed
      external_task_status:
        description: Status of sync to appliance. 
        type: string
        title: Appliance Sync Status
        enum:
        - success
        - failed
        - not_started
        - in_progress
        example: not_started
      external_task_updated_at:
        description: Time when sync status was last updated. 
        format: date-time
        title: Appliance Sync Status Updated At
        type: string
      external_task_error:
        description: Error details if syncing to the appliance fails
        title: Sync and Validation Error Details
        type: string
        x-nullable: true
        example: null
      external_task_error_code:
        description: A numeric code for syncing and validation errors occuring during appliance syncing.
        type: integer
        example: null
        x-nullable: true
    type: object
  VectraMatchRuleUploadPostV3_3:
    properties:
      urls:
        description: List of urls to upload a Match rules file.
        items:
          type: string
          description: URL to upload the file data
          example: "https://urlforupload.com"
        title: Upload URLs
        type: array
      id:
        type: string
        description: UUID of file upload.
        example: "r90f41hj-1092-1290-5t36-1ka0w901ct8q"
    type: object
  HealthSummary:
    properties:
      connection_status:
        description: Current connection status.
        type: string
        title: Connection Status
        enum:
        - enabled
        - disabled
        example: enabled
      auth_status: 
        description: Authentication status. This is not displayed for disabled connectors.
        type: object
        title: Authentication Status
        enum:
        - authenticated
        - not_authenticated
        - not_configured
        example:
          status: authenticated
      lockdown_status:
        description: If lockdown can be enabled for a tenant, the enabled status will be reflected. 'enabled' or 'not_enabled'. 
          This is not displayed for disabled connectors or for connectors without lockdown enablement.
        type: string
        title: Lockdown Status
        example: enabled
      error_states:
        description: List of current error states. If a connection is in error, the error message will be listed here. 
          This is not displayed for disabled connectors.
        title: Error States
        type: object
        example: {}
    type: object
  HealthExternalConnectorsV3_4:
    type: object
    title: Success
    properties:
      results:
        type: object
        title: Results
        properties:
          active_directory:
            title: Active directory
            description: Summary of health status of active directory
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          azure_ad_lockdown:
            title: Azure AD Lockdown
            description: Summary of health status of Azure AD Lockdown
            type: object
            $ref: '#/definitions/HealthSummary'
            example: 
              connection_status: enabled
              auth_status: 
                status: authenticated
              lockdown_status: 
                status: enabled
          aws:
            title: AWS
            description: Summary of health status of AWS
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          azure:
            title: Azure
            description: Summary of health status of Azure
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          google_cloud:
            title: Google cloud
            description: Summary of health status of Google cloud
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          reverse_lookup_dns:
            title: Reverse DNS Lookup
            description: Summary of health status o fReverse DNS Lookup
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          siem:
            title: SIEM
            description: Summary of health status of SIEM
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          vcenter:
            title: Vcenter
            description: Summary of health status of Vcenter
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          windows_event_log_ingestion:
            title: Windows Event Log Ingestion
            description: Summary of health status of Windows Event Log Ingestion
            type: object
            $ref: '#/definitions/HealthSummary'
            example: 
              connection_status: enabled
              auth_status: 
                  status: not_configured
              error_states: 
                  status: Not connected
          zscaler_private_access:
            title: Zscaler
            description: Summary of health status of Zscaler
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
      updated_at:
        type: string
        format: date-time
        title: Updated at
        example: '2025-03-03T10:46:38Z'
        description: The time when the health status was fetched.
  HealthExternalConnectorsDetailsV3_4:
    title: Success
    properties:
      results:
        description: Details for external connectors. Varies per connector.
        type: object
        title: Results
        example: 
          active_directory:
            connection_status: disabled
          azure_ad_lockdown:
            connection_status: enabled
            details:
              lockdownAutoType: lock
              lockdownAutoUrgency: 100
              lockdownEnabled: true 
              lockdownManualEnabled: true
              lockdownAutoEnabled: false
              consentState: CONSENT_REGISTERED_TOKEN_VALID
          aws:
            connection_status: enabled
            details:
              status: enabled
              severity: misc-yep
              coverageReportAvailable: true 
          azure:
            connection_status: disabled
          google_cloud:
            connection_status: disabled
          reverse_lookup_dns:
            connection_status: disabled
          siem:
            connection_status: disabled
          vcenter:
            connection_status: disabled
          windows_event_log_ingestion:
            connection_status: disabled
          zscaler_private_access:
            connection_status: disabled
      updated_at:
        type: string
        format: date-time
        title: Updated at
        example: '2025-03-03T10:46:38Z'
        description: The time when the health status was fetched.
    type: object
  HealthEDRV3_4:
    title: Success
    properties:
      results:
        type: object
        title: Results
        properties:
          carbon_black:
            title: Carbon black
            description: Summary of health status of Carbon black
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          cb_cloud:
            title: CB Cloud
            description: Summary of health status of CB Cloud
            type: object
            $ref: '#/definitions/HealthSummary'
            example: 
              connection_status: enabled
              auth_status: 
                status: authenticated
              error_states: {}
              lockdown_status: enabled
          crowdstrike:
            title: Crowdstrike
            description: Summary of health status of Crowdstrike
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          cybereason:
            title: Cybereason
            description: Summary of health status of Cybereason
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          fireeye:
            title: Fireeye
            description: Summary of health status of Fireeye
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          host_lockdown:
            title: Host Lockdown
            description: Summary of health status of host Lockdown
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          sentinelone:
            title: Sentinel one
            description: Summary of health status of Sentinel one
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
          windows_defender:
            title: Windows Defender
            description: Summary of health status of Windows Defender
            type: object
            $ref: '#/definitions/HealthSummary'
            example:
              connection_status: disabled
      updated_at:
        type: string
        format: date-time
        title: Updated at
        example: '2025-03-03T10:46:38Z'
        description: The time when the health status was fetched.
    type: object
  HealthEDRDetailsV3_4:
    title: Success
    properties:
      results:
        description: Details for EDR connection. Varies per connector.
        type: object
        title: Results
        example:
          carbon_black:
            edr_type: carbon_black
            connection_status: disabled
          cb_cloud:
            edr_type: cb_cloud
            connection_status: disabled
          crowdstrike:
            edr_type: crowdstrike
            connection_status: disabled
          cybereason:
            edr_type: cybereason
            connection_status: enabled
            details:
              - statusType: alert
                text: Received error Not Found (HTTP code 404) from Cybereason
          fireeye:
            edr_type: fireeye
            connection_status: disabled
          host_lockdown:
            edr_type: host_lockdown
            connection_status: enabled
            details:
              activeIntegrations:
                - Cybereason
              lockdownAutoEnabled: true
          sentinelone:
            edr_type: sentinelone
            connection_status: disabled
          windows_defender:
            edr_type: windows_defender
            connection_status: disabled
      updated_at:
        type: string
        format: date-time
        title: Updated at
        example: '2025-03-03T10:46:38Z'
        description: The time when the health status was fetched.
    type: object
  HealthNetworkBrainPingV3_4:
    type: object
    title: Success
    properties:
      results:
        description: Ping results.
        type: object
        title: Results
        properties:
          ping:
            description: Brain enabled status.
            type: string
            title: Network Brain Ping
            example: Brain enabled
          latency: 
            description: Time taken to get brain status in milliseconds.
            type: string
            title: Latency
            example: 122.01ms
  VectraMatchCuratedRulesetDownloadV3_3:
    properties:
      download_url:
        description: Download URL for the curated ruleset.
        type: string
        format: url
        example: "https://dev-customerfiles-182909264718-uswst1.s3.amazonaws.com"
    type: object
  UniqueHostAuditSerializerV3_4:
    type: object
    properties:
      host_id:
        type: integer
        description: Related Host ID.
        example: 1
      host_luid:
        type: string
        description: Related Host LUID.
        example: "KLOZdusj"
      ip_address:
        type: string
        description: Related Host IP address.
        example: 100.100.100.100
        format: ipv4
      host_artifact_value:
        type: string
        example: VHE9102t9c9g82a91026yu5d71b9102f89z
        description: Host Artifact Value (if available).
      host_artifact_type:
        type: string
        description: Host Artifact Type (if available).
        example: crowdstrike
      last_seen_start:
        type: string
        format: date-time
        example: "2024-01-24T21:57:13Z"
        description:
          Last seen start.  The column is 'last_seen' because it gets updated at
          new host sessions are created. Host may have been seen at more times
          than what is recorded.
      last_seen_end:
        type: string
        format: date-time
        example: "2024-02-22T21:27:33Z"
        description:
          Last seen end.  The column is 'last_seen' because it gets updated at
          new host sessions are created. Host may have been seen at more times
          than what is recorded.
  Error400Ouath2:
    properties:
      error:
        type: string
        enum: 
        - "Missing required field: 'grant_type' must be one of ['client_credentials', 'refresh_token']"
        - Missing refresh_token
        - Invalid refresh token. Please reauthenticate using client credentials and try again.
        - 
  Error401:
    properties:
      error:
        type: string
        enum: 
        - Authorization Failed. Please retry.
        - Authentication Error. Please try reauthenticating using API client credentials.
        - Authorization Failed. Please ensure both client id and secret were provided and retry.
        - Invalid client credentials
  Error403:
    properties:
      detail:
        type: string
        enum: 
        - You do not have permission to perform this action.
  Error413:
    properties:
      error:
        type: string
        enum: 
        - Response too large to render.
        - "File size exceeds limit"
  Error429:
    properties:
      error:
        type: string
        enum: 
        - Too many requests. Please wait and reattempt.
  Error500:
    title: Unexpected error.
    properties:
      error:
        type: string
        enum: 
        - An unexpected exception occurred.
  Error503:
    properties:
      error:
        type: string
        enum: 
        - Service Unavailable
  Error504:
    properties:
      message:
        type: string
        enum: 
        - Endpoint request timed out
  Error400InvalidParams:
    type: object
    title: Invalid query parameters
    description: 'Invalid query parameters requested.'
    properties:
      detail:
        type: string
        enum: 
        - 'The following query parameter(s) are invalid: invalid_param'
  Error400InvalidParamValue:
    type: object
    title: Invalid query parameter values
    description: ''
    properties:
      valid_param:
        type: string
        enum: 
        - "Invalid value given for paramater 'valid_param'. Valid values: ['valid_value']"
      _meta:
        type: object
        properties:
          message:
            type: string
            enum:
            - "Ivalid field(s) found"
          level:
            type: string
            enum:
            - error
  Error422PatchDetections:
    type: object
    title: Invalid input for patching detections.
    description: Invalid input for patching detections.
    properties:
      errors:
        type: object
        description: An object containing validation errors.
        oneOf:
          - type: object
            title: detectionIdList error
            properties:
              detectionIdList:
                type: array
                items:
                  type: string
                  enum:
                    - "detectionIdList is not a list"
                    - "detectionIdList is required"
                    - "Invalid ID."
                    - "ID needs to be greater than 0."
          - type: object
            title: mark_as_fixed error
            properties:
              mark_as_fixed:
                type: array
                items:
                  type: string
                  enum:
                  - "mark_as_fixed is required"
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
  Error404PatchDetections:
    type: object
    title: 'Not found error.'
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: string
            enum:
            - 'Failed to mark detections: no valid detection ids provided'
  Error400MissingReasonParam:
    type: object
    title: Missing reason parameter.
    description:  Missing reason parameter.
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: object
            properties:
              reason:
                type: string
                example: Reason is required
  Error400DetectionIdListInvalidType:
    type: object
    title: Invalid detectionIdList type.
    description:  Invalid detectionIdList type.
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: object
            properties:
              detectionIdList:
                type: string
                example: detectionIdList must be a list
  Error400MissingDetectionIdList:
    type: object
    title: Missing detectionIdList parameter.
    description:  Missing detectionIdList parameter
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: object
            properties:
              detectionIdList:
                type: string
                example: detectionIdList is required
  Error400DetectionIdListInvalidIdType:
    type: object
    title: Invalid Id provided
    description:  Invalid Id provided
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: object
            properties:
              detectionIdList:
                type: string
                example: detectionIdList must contain only non-negative integers
      errors:
        type: object
        properties: 
          invalid_ids:
            type: array
            items:
              type: string
              example: [-1, invalid_id]
  Error422InvalidReason:
    type: object
    title: Invalid reason parameter.
    description: Invalid reason parameter.
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: object
            properties:
              reason:
                type: string
                example: Invalid reason provided. Valid values are remediated or benign.
  Error404Generic:
    title: Not found error.
    type: object
    properties:
      detail:
        type: string
        enum:
        - 'Not found.'
  Error404Rules:
    description: Not found error.
    type: object
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: string
            enum:
            - Invalid field(s) found
  Error404InvalidPage:
    type: object
    properties:
      detail:
        type: string
        enum:
        - 'Invalid page "49459": That page contains no results.'
  Error404InvalidDetectionId:
    type: object
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum: 
            - error
          message:
            type: object
            properties:
              detectionIdList:
                type: string
                example: "Some detection IDs were not found."
      errors:
        type: object
        properties:
          invalid_ids:
            type: array
            example: 
              - 220
  Error422PostRulesInvalidField:
    type: object
    title: 'Invalid input in the request body.'
    properties:
      detection:
        type: array
        items:
          type: string
          enum:
            - "This field may not be null."
            - "'invalid_detection' is not a valid 'detection'."
      is_whitelist:
        type: array
        items:
          type: string
          enum:
            - "This field may not be null."
            - "Expected a 'boolean' but got type 'str'."
      detection_category:
        type: array
        items:
          type: string
          enum:
            - "This field may not be null."
            - "'invalid_category' is not a valid 'detection'."
      triage_category:
        type: array
        items:
          type: string
          enum:
            - "'triage_category' is not a string."
            - "'triage_category' contains illegal characters."
            - "'triage_category' should be four or more characters."
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: string
            enum:
            - Invalid field(s) found
  Error422PostRulesConditionsField:
    type: object
    title: Invalid input for triage conditions.'
    properties:
      additional_conditions:
        type: array
        items:
          type: string
          enum:
            - 'The field "additional_conditions" is missing. Maybe you used "additionalConditions"?'
      source_conditions:
        type: array
        items:
          type: string
          enum:
            - 'The field "source_conditions" is missing. Maybe you used "sourceConditions"?'
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: string
            enum:
            - Invalid field(s) found
  Error422PostRulesDetectionList:
    type: object
    title: Invalid input for filtering a set of detections.
    properties:
      errors:
        type: object
        properties:
          detectionIdList:
            type: array
            items:
              type: string
              enum:
                - "detectionIdList is not a list"
                - "Invalid ID."
                - "ID needs to be greater than 0."
          detectionId:
            type: array
            items:
              type: string
              enum:
                - "Invalid ID."
                - "ID needs to be greater than 0."
          triage_category:
            type: array
            items:
              type: string
              enum:
                - "'triage_category' is not a string."
                - "'triage_category' contains illegal characters."
                - "'triage_category' should be four or more characters."
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
  Error422DeleteRulesDetectionList:
    type: object
    title: Invalid input for unfiltering a set of detections.
    description: Invalid input for unfiltering a set of detections.
    properties:
      errors:
        type: object
        description: An object containing validation errors.
        properties:
          detectionIdList:
            type: array
            items:
              type: string
              enum:
                - "detectionIdList is not a list"
                - "Invalid ID."
                - "ID needs to be greater than 0."
                - "No detection list provided. In order to bulk unmark as custom, please provide a list of detection IDs to unmark"
  Error404Tags:
    description: Tag entity requested was not found.
    type: object
    properties:
      status:
        type: string
        enum:
        - failure
      message:
        type: string
        enum:
        - Could not find requested object
  Error400PatchTagsMissingTags:
    title: "Missing input field in the request body."
    type: object
    properties:
      status:
        type: string
        enum:
        - failure
      message:
        type: string
        enum:
        - no tags contained in request
        - no tag contained in request
        - no objectIds contained in request
  Error400PatchTagsInvalidTagType:
    title: 'Incorrect type for the "tags" parameter.'
    type: object
    properties:
      status:
        type: string
        enum:
        - failure
      message:
        type: string
        enum:
        - Tags must be a list of valid strings
  Error400PatchTagsInvalidTag:
    title: 'Invalid tag(s) passed in the list of tags.'
    type: object
    properties:
      tags:
        type: string
        enum:
        - "Invalid value(s) [1, 2] given in parameter tags. Must only contain valid tags."
      _meta:
        type: object
        properties:
          message:
            type: string
            enum:
            - Invalid field(s) found
          level:
            type: string
            enum:
            - error
  Error404BulkPatchTags:
    description: "Invalid table input."
    type: object
    properties:
      status:
        type: string
        enum:
        - failure
      message:
        type: string
        enum:
        - 'Invalid table: invalid_table' 
        - Could not find requested object
  Error400BulkInvalidTag:
    title: "Invalid tag input."
    type: object
    properties:
      status:
        type: string
        enum:
        - failure
      message:
        type: string
        enum:
        - 'Invalid tag: invalid_tag' 
  Error400GetAssignments:
    description: "Invalid input error."
    type: array
    items:
      type: string
      enum:
        - "Cannot filter on both accounts and hosts."
        - Insufficient permissions to view assignments for accounts.
        - Insufficient permissions to view assignments for hosts.
  Error400PostAssignments:
    type: object
    properties:
      errors:
        type: array
        items: 
          type: object
          properties:
            title:
              type: string
              enum:
              - Only one of assign_account_id or assign_host_id can be specified.
              - Please specify assign_account_id or assign_host_id.
              - Please specify assign_to_user_id.
              - Unable to look up specified entity
              - "Field 'assign_to_user_id' expected a number but got invalid_id."
              - User 1 does not have permissions to be assigned to accounts.
  Error400ResolveAssignmentsOutcome:
    type: object
    title: 'Invalid input for "outcome".'
    description: 'Invalid input for "outcome".'
    properties:
      outcome:
        type: array
        items:
          type: string
          enum:
            - "A valid integer is required."
            - "This field is required."
            - "100001010  is not a valid outcome id."
  Error400ResolveAssignmentsDetectionIDs:
    type: object
    title: 'Invalid input for "detection_ids".'
    description: 'Invalid input for "detection_ids".'
    properties:
      detection_ids:
        type: array
        items:
          type: string
          enum:
            - 'Expected a list of items but got type "int".'
            - '"0": ["A valid integer is required."]'
            - "Detection id(s) {1, 2} do not exist on this host."
            - "Detection id(s) {1, 2}have already been triaged."
  Error400ResolveAssignmentsTriageAs:
    type: object
    title: 'Invalid input for "triage_as".'
    description: 'Invalid input for "triage_as".'
    properties:
      triage_as:
        type: array
        items:
          type: string
          enum:
            - "triage_as should be four or more characters."
            - 'triage_as contains illegal characters.'
            - "triage_as is not a string."
  Error409ResolveAssignments:
    type: object
    title: 'Conflict error, assignment hsa already been resolved.'
    properties:
      detail:
        type: string
        enum:
        - "Assignment has already been resolved."
  Error400PostNotes:
    type: object
    title: 'Note missing input.'
    properties:
      note:
        type: array
        items: 
          type: string
          enum:
          - "This field is required."
          - "Not a valid string."
          - "This field may not be blank."
  Error404URLNotFound:
    type: object
    title: 'Invalid path input for entity type.'
    properties:
      status:
        type: integer
        enum:
        - 404
      reason:
        type: string
        enum:
        - "URL Not Found"
  Error422PatchNoteMissingNote:
    type: object
    title: 'Invalid input error.'
    properties:
      message:
        type: string
        enum:
        - 'Invalid or missing body data. "note" is a required key.'
  Error400EventInvalidParam:
    type: object
    title: 'Invalid input error.'
    properties:
      detail:
        type: string
        enum:
        - "The following query parameter(s) are invalid: invalid_param"
  Error400PostAssignmentOutcomes:
    type: object
    title: 'Invalid input error.'
    properties:
      title:
        type: array
        items: 
          type: string
          enum:
          - "This field is required."
          - "Not a valid string."
      category:
        type: array
        items: 
          type: string
          enum:
          - "This field is required."
          - "invalid_category is not a valid choice."
  Error400DeleteAssignmentOutcome:
    type: object
    title: 'Invalid input error.'
    properties:
      detail:
        type: string
        enum:
        - "Assignment outcome 1 is built-in and cannot be modified."
        - "The outcome cannot be deleted after it has been used to resolve an assignment."
  Error400EntitiesMissingTypeParam:
    type: object
    title: Missing type parameter
    properties:
      detail:
        type: string
        enum: 
        - "The following query parameter(s) are required: entity_type"
        - "The following query parameter(s) are required: type"
  Error400JsonParse:
    type: object
    title: JSON parse error
    properties:
      detail:
        type: string
        enum: 
        - "JSON parse error - Expecting property name enclosed in double quotes: line 5 column 33 (char 172)"
  Error400InvalidJson:
    type: object
    title: Invalid JSON error
    properties:
      error:
        type: string
        enum: 
        - "Payload must be valid JSON"
  Error400InvalidBodyParam:
    type: object
    title: Invalid body parameter
    properties:
      detail:
        type: string
        enum: 
        - "The following request body fields are invalid/unsupported: invalid_param"
  Error422GroupsMissingBodyParam:
    type: object
    title: Missing body parameter
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: object
            properties:
              members:
                type: list
                items: 
                  type: string
                  enum:
                  - "This field may not be null."
              name:
                type: list
                items: 
                  type: string
                  enum:
                  - "This field may not be null."
  Error400GroupsTypeV3_2:
    type: object
    title: Invalid type error.
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: string
            enum:
            - Host, IP, and Domain Groups are not valid before API v3.3. Please request an Account Group.
  Error422GroupsDelete:
    type: object
    title: Invalid deletion error.
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: string
            enum:
            - Cannot delete group attached to triage filters
  Error400GroupsPatchTypeChange:
    type: object
    title: Type change error.
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: string
            enum:
            - Group type cannot be changed
  Error422GroupsPatchTypeV3_2:
    type: object
    title: Invalid type error.
    properties:
      type:
        type: string
        enum:
        - Invalid group type provided
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: string
            enum:
            - Cannot update a non-account type group
  Error422GroupsBody:
    type: object
    title: Invalid member error.
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: object
            properties:
              members:
                type: string
                enum:
                - "Invalid account id value provided for Account Group"
                - "Account ids not found: 182849405"
              importance:
                type: string
                enum:
                - "Importance cannot be empty"
                - "Importance must be one of the following: ['high', 'medium', 'low', 'never_prioritize']"
              name:
                type: string
                enum:
                - "Group names cannot be empty"
                - "Group name is not valid"
              description:
                type: string
                enum:
                - "Group description is not valid"
  Error415InvalidMediaType:
    type: object
    title: Unsupported media type error.
    properties:
      error:
        type: string
        enum:
        - Unsupported Media Type
  Error422GroupsInvalidType:
    type: object
    title: Invalid type error.
    properties:
      type:
        type: string
        enum:
        - Invalid group type provided
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: string
            enum:
            - Invalid field(s) found
  Error415InvalidMediaTypeDetail:
    type: object
    title: Unsupported media type error.
    properties:
      detail:
        type: string
        enum:
        - 'Unsupported media type "text/plain" in request.'
  Error400RepeatedType:
    type: object
    title: Conflicting query parameters
    description: ''
    properties:
      type:
        type: string
        enum: 
        - "Please only use the 'type' param. 'entity_type' and 'type' should not both be used in the same request."
      _meta:
        type: object
        properties:
          message:
            type: string
            enum:
            - "Ivalid field(s) found"
          level:
            type: string
            enum:
            - error
  Error400InvalidHealthCheck:
    type: object
    title: Invalid health check
    description: ''
    properties:
      error:
        type: string
        enum: 
        - '"invalid_check" is not a valid health check'
  Response200NtCCheck:
    type: object
    title: Network to SaaS not available
    properties:
      message:
        type: string
        enum: 
        - "No information available for this endpoint."
  Error400BulkNotesEmptyValue:
    type: object
    title: Body field is empty error
    properties:
      note:
        type: string
        enum: 
        - "This field may not be blank."
      objectIds:
        type: string
        enum: 
        - "This field may not be an empty list."
  Error404BulkNotesNotFound:
    type: object
    title: ID list not found
    properties:
      detail:
        type: string
        enum: 
        - "The following requested IDs 1, 2 do not exist."
  Error400BulkNotesInvalidBodyValue:
    type: object
    title: Body field invalid value error
    properties:
      detail:
        type: string
        enum: 
        - "The following request body fields were provided with invalid values: note"
  Error400BulkNotesMissingBodyParam:
    type: object
    title: Missing body field error
    properties:
      detail:
        type: string
        enum: 
        - "The following body parameter(s) are required: note"
  Error400BulkNotesExtraBodyParam:
    type: object
    title: Invalid body field error
    properties:
      detail:
        type: string
        enum: 
        - "The following request body fields are invalid/unsupported: extra_field"
  Error400NoteInvalidType:
    type: object
    title: Invalid type error
    properties:
      detail:
        type: string
        enum: 
        - "The provided entity type is invalid, please use one of the following: host, detection, campaign, account, linked_account"
  Error400TaggingInvalidType:
    type: object
    title: Invalid type error
    properties:
      detail:
        type: string
        enum: 
        - "The provided entity type is invalid, please use one of the following: detection, host, detection_detail, account, linked_account"
  Error400MatchEnablement:
    type: object
    title: Invalid input error
    properties:
      details:
        type: string
        enum: 
        - "device_serial not provided or is not a string"
        - "device_serials not provided or is not a list"
        - "desired_state not provided or is not a boolean"
        - uuid not provided or is not a string
        - Provided rules file uuid is invalid
  Error404MatchEnablement:
    type: object
    title: Device serial not found
    properties:
      details:
        type: string
        enum: 
        - "Provided device serial is not connected/paired"
        - "Provided rules file uuid does not exist"
        - "Failed to delete Vectra Match rules assignment due to invalid uuid or serial, which does not exist or is not paired"
        - "Failed to assign Vectra Match ruleset, due to invalid uuid or serial which does not exist or is not paired"
  Error400MatchRuleUploadGet:
    type: object
    title: Invalid input error
    properties:
      message:
        type: string
        enum: 
        - "Invalid data passed"
        - 'Value Error when getting file'
        - 'Type error when getting file'
  Error404MatchRuleUploadGet:
    type: object
    title: Not found error
    properties:
      message:
        type: string
        enum:
        - ObjectDoesNotExist when getting file
  Error400MatchRuleUploadPost:
    type: object
    title: Invalid input error
    properties:
      message:
        type: string
        enum: 
        - 'Value Error when creating file'
        - Failed creating the file, bad data passed'
        - Type error when creating file
  Error400MatchRuleUploadPatch:
    type: object
    title: Invalid input error
    properties:
      message:
        type: string
        enum: 
        - 'Missing or invalid "status" value'
        - Value Error when updating file'
        - Type error when creating file
  Error404MatchRuleUploadPatch:
    type: object
    title: Not found error
    properties:
      message:
        type: string
        enum: 
        - 'Model not found for updates'
  Error404Threatfeed:
    type: object
    title: Not found error
    properties:
      errors:
        type: array
        items: 
          type: objects
          properties:
            title:
              type: string
              enum:
              - Threat feed does not exist.
  Error404ThreatfeedFile:
    type: object
    title: Not found error
    properties:
      errors:
        type: array
        items: 
          type: objects
          properties:
            title:
              type: string
              enum:
              - no file in threat feed.
              - 'No file linked to threat feed.'
  Error500ThreatfeedFile:
    type: object
    title: Connection error.
    properties:
      status:
        type: string
        enum:
        - error
      reason:
        type: string
        enum:
        - Appliance Connection Failed
  Error409ThreatfeedFileConflict:
    type: object
    title: Conflict error.
    properties:
      errors:
        type: array
        items: 
          type: objects
          properties:
            title:
              type: string
              enum:
              - Could not save threat feed.
  Error422GetThreatfeeds:
    type: object
    title: Invalid input error.
    properties:
      errors:
        type: array
        items: 
          type: objects
          properties:
            title:
              type: string
              enum:
              - Invalid ordering parameter.   
  Error422PostThreatfeeds:
    type: object
    title: Invalid input error.
    properties:
      errors:
        type: array
        items: 
          type: objects
          properties:
            title:
              type: string
              enum:
              - A threat feed with that name already exists.
              - Required JSON keys not present. 
              - Feed name is too long.
              - Feed contains invalid values.
  Error409PostThreatfeeds:
    type: object
    title: Conflict error.
    properties:
      errors:
        type: array
        items: 
          type: objects
          properties:
            title:
              type: string
              enum:
              - Could not save threat feed.
              Error409PostThreatfeeds:
  Error400PostThreatfeeds:    
    type: object
    title: Invalid JSON body.
    properties:
      errors:
        type: array
        items: 
          type: objects
          properties:
            title:
              type: string
              enum:
              - Malformed JSON request.
              - Failed parsing STIX file.
  Error422PostThreatfeedId:
    type: object
    title: Invalid input error.
    properties:
      errors:
        type: array
        items: 
          type: objects
          properties:
            title:
              type: string
              enum:
              - Improperly formatted request.
              - No file present in request.
              - No supported observables.
              - Key missing in request.
              - 'Request contains forbidden characters.'
              - A threat feed with that name already exists.
              - No file was uploaded.
  Error404PostThreatfeedId:
    type: object
    title: Not found error.
    properties:
      errors:
        type: array
        items: 
          type: objects
          properties:
            title:
              type: string
              enum:
              - Threat Feed not found.
              - Could not retrieve threat feed.
              - Expired file.
              - can not retrieve threat feed
  Error422PatchThreatfeedId:
    type: object
    title: Invalid input error.
    properties:
      status:
        type: string
        enum:
          - error
      reason:
        type: string
        enum:
          - threat feed name is too long
  Error400UniqueHostObserved:
    type: object
    title: Conflicting parameters error.
    properties:
      message:
        type: string
        enum:
          - last_month_only and start/end params cannot be used together.
          - 'start must be before end. start: 2025-11-01, end: 2024-01-01'
  Error403MatchDownloadRulset:
    type: object
    title: Invalid license error.
    properties:
      details:
        type: string
        enum:
          - License is not valid for Vectra Match.
  Error404MatchDownloadRulset:
    type: object
    title: Invalid license error.
    properties:
      details:
        type: string
        enum:
          - Vectra curated ruleset was not found.
  Error500MatchDownloadRulset:
    type: object
    title: Unexpected match error.
    properties:
      details:
        type: string
        enum:
          - Unexpected or error response from Vectra Match received
  Error403DeleteUser:
    type: object
    title: Super user deletion error.
    properties:
      error:
        type: string
        enum:
          - Cannot delete last remaining verified Super Admin user.
  Error400UserInput:
    type: object
    title: Invalid role input.
    properties:
      error:
        type: string
        enum:
          - "Invalid role provided. Query api/v3.4/users/roles for the role's standardized_name."
          - Cannot modify the role of a currently active SAML user.
          - The name field requires space separated first and last name.
          - Cannot modify the name of a currently active SAML user.
  Error400UsersListRole:
    type: array
    title: Invalid role input.
    items:
      type: string
      enun:
      - "Invalid role provided. Query api/v3.4/users/roles for a list of valid roles. Filter with a role's standardized_name."
  Error400UsersPostInvalidInput:
    type: object
    title: Invalid input error.
    properties:
      error:
        type: string
        enum:
        - "Missing required request body params: ['required_param']"
        - "Invalid role provided. Query api/v3.4/users/roles for the role's standardized_name."
        - The name field requires space separated first and last name.
        - A user profile with this email already exists.
  Error422UsersPostInvalidEmail:
    type: object
    title: Invalid email error.
    properties:
      error:
        type: string
        enum:
        - "Invalid email address."
  Error500BrainPing:
    type: object
    title: Health check error.
    properties:
      error:
        type: string
        enum:
        - "Encountered an error running health check."
  Response200HealthEvaluation:
    type: object
    title: Health evaluation status.
    properties:
      detail:
        type: string
        enum:
        - "Retrieving data. Call this endpoint again with live=False. Task Status: STARTED"
        - No cached integration information at this time. Please try again with live=True.
  Error400UniqueHostsV3_4:
    type: object
    title: Invalid timerange error.
    properties:
      error:
        type: string
        enum:
        - "Invalid timerange provided"
  Error409UniqueHostsV3_4:
    type: object
    title: No host data available.
    properties:
      error:
        type: string
        enum:
        - "No host data available for given timerange. Start: 2024-01-01, End: 2024-01-10"
  Error422GroupsRegexConflict:
    type: object
    title: Regex conflict error.
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: string
            enum:
            - "Regex should only be used with Host or Account Groups."
            - Members cannot be specified when creating a regex group. Please only provide a regex. Members will be added upon creation.
  Error422GroupsRegexInvalid:
    type: object
    title: Invalid regex error.
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: object
            properties:
              regex:
                type: string
                enum:
                - compiling error
  Error409PostGroups:
    type: object
    title: Name conflict error.
    properties:
      _meta:
        type: object
        properties:
          level:
            type: string
            enum:
            - error
          message:
            type: object
            properties:
              regex:
                type: string
                enum:
                - "Attempt to create group with duplicate name: duplicate_name"
  Response201MatchAssignment:
    properties:
      details:
        description: Details will be 'success' if successful, otherwise, will
          contain information about the failure. 
        type: string
        example: success
    type: object
tags:
  # Auth
  - name: auth
    description: Authorization 
    x-displayName: Authorization

  # V3.4
  - name: v3.4/accounts
    description: Vectra REST API Version 3.4 - Accounts
    x-displayName: Accounts
  - name: v3.4/assignments
    description: Vectra REST API Version 3.4 - Assignments 
    x-displayName: Assignments
  - name: v3.4/assignment_outcomes
    description: Vectra REST API Version 3.4 - Assignment Outcomes 
    x-displayName: Assignment Outcomes
  - name: v3.4/data_source/connectors
    description: Vectra REST API Version 3.4 - Data Source Connectors
    x-displayName: Data Source Connectors
  - name: v3.4/detections
    description: Vectra REST API Version 3.4 - Detections 
    x-displayName: Detections
  - name: v3.4/entities
    description: Vectra REST API Version 3.4 - Entities 
    x-displayName: Entities
  - name: v3.4/events
    description: Vectra REST API Version 3.4 - Events
    x-displayName: Events
  - name: v3.4/groups
    description: Vectra REST API Version 3.4 - Groups 
    x-displayName: Groups
  - name: v3.4/health
    description: Vectra REST API Version 3.4 - Health 
    x-displayName: Health
  - name: v3.4/health/edr
    description: Vectra REST API Version 3.4 - Health - EDR
    x-displayName: Health - EDR
  - name: v3.4/health/external_connectors
    description: Vectra REST API Version 3.4 - Health - External Connectors
    x-displayName: Health - External Connectors
  - name: v3.4/health/network_brain
    description: Vectra REST API Version 3.4 - Health - Network Brain
    x-displayName: Health - Network Brain
  - name: v3.4/hosts
    description: Vectra REST API Version 3.4 - Hosts 
    x-displayName: Hosts
  - name: v3.4/lockdown
    description: Vectra REST API Version 3.4 - Lockdown 
    x-displayName: Lockdown
  - name: v3.4/match
    description: Vectra REST API Version 3.4 - Match
    x-displayName: Match
  - name: v3.4/notes
    description: Vectra REST API Version 3.4 - Notes
    x-displayName: Notes
  - name: v3.4/settings/active_directory/groups
    description: Vectra REST API Version 3.4 - Settings - Active Directory Groups
    x-displayName: Settings - Active Directory Groups
  - name: v3.4/rules
    description: Vectra REST API Version 3.4 - Triage Rules 
    x-displayName: Triage Rules
  - name: v3.4/tagging
    description: Vectra REST API Version 3.4 - Tagging 
    x-displayName: Tagging
  - name: v3.4/threatFeeds
    description: Vectra REST API Version 3.4 - Threat Feeds
    x-displayName: Threat Feeds
  - name: v3.4/unique_hosts
    description: Vectra REST API Version 3.4 - Unique Hosts
    x-displayName: Unique Hosts
  - name: v3.4/users
    description: Vectra REST API Version 3.4 - Users
    x-displayName: Users
  - name: v3.4/deprecated
    description: Vectra REST API Version 3.4 - Deprecated Endpoints
    x-displayName: Deprecated Endpoints
  
  # V3.3
  - name: v3.3/accounts
    description: Vectra REST API Version 3.3 - Accounts
    x-displayName: Accounts
  - name: v3.3/assignments
    description: Vectra REST API Version 3.3 - Assignments 
    x-displayName: Assignments
  - name: v3.3/assignment_outcomes
    description: Vectra REST API Version 3.3 - Assignment Outcomes 
    x-displayName: Assignment Outcomes
  - name: v3.3/detections
    description: Vectra REST API Version 3.3 - Detections 
    x-displayName: Detections
  - name: v3.3/entities
    description: Vectra REST API Version 3.3 - Entities 
    x-displayName: Entities
  - name: v3.3/events
    description: Vectra REST API Version 3.3 - Events 
    x-displayName: Events
  - name: v3.3/groups
    description: Vectra REST API Version 3.3 - Groups 
    x-displayName: Groups
  - name: v3.3/health
    description: Vectra REST API Version 3.3 - Health 
    x-displayName: Health
  - name: v3.3/hosts
    description: Vectra REST API Version 3.3 - Hosts 
    x-displayName: Hosts
  - name: v3.3/lockdown
    description: Vectra REST API Version 3.3 - Lockdown 
    x-displayName: Lockdown
  - name: v3.3/match
    description: Vectra REST API Version 3.3 - Match
    x-displayName: Match
  - name: v3.3/notes
    description: Vectra REST API Version 3.3 - Notes
    x-displayName: Notes
  - name: v3.3/rules
    description: Vectra REST API Version 3.3 - Triage Rules 
    x-displayName: Triage Rules
  - name: v3.3/tagging
    description: Vectra REST API Version 3.3 - Tagging 
    x-displayName: Tagging   
  - name: v3.3/threatFeeds
    description: Vectra REST API Version 3.3 - Threat Feeds
    x-displayName: Threat Feeds
  - name: v3.3/unique_hosts
    description: Vectra REST API Version 3.3 - Unique Hosts
    x-displayName: Unique Hosts
  - name: v3.3/users
    description: Vectra REST API Version 3.3 - Users
    x-displayName: Users
  - name: v3.3/deprecated
    description: Vectra REST API Version 3.3 - Deprecated Endpoints
    x-displayName: Deprecated Endpoints

  # V3.2 
  - name: v3.2/accounts
    description: Vectra REST API Version 3.2 - Accounts
    x-displayName: Accounts
  - name: v3.2/assignments
    description: Vectra REST API Version 3.2 - Assignments 
    x-displayName: Assignments
  - name: v3.2/assignment_outcomes
    description: Vectra REST API Version 3.2 - Assignment Outcomes 
    x-displayName: Assignment Outcomes
  - name: v3.2/detections
    description: Vectra REST API Version 3.2 - Detections 
    x-displayName: Detections 
  - name: v3.2/entities
    description: Vectra REST API Version 3.2 - Entities 
    x-displayName: Entities
  - name: v3.2/events
    description: Vectra REST API Version 3.2 - Events 
    x-displayName: Events
  - name: v3.2/groups
    description: Vectra REST API Version 3.2 - Groups 
    x-displayName: Groups
  - name: v3.2/notes
    description: Vectra REST API Version 3.2 - Notes
    x-displayName: Notes
  - name: v3.2/rules
    description: Vectra REST API Version 3.2 - Triage Rules 
    x-displayName: Triage Rules
  - name: v3.2/tagging
    description: Vectra REST API Version 3.2 - Tagging 
    x-displayName: Tagging   

  # V3.1
  - name: v3.1/accounts
    description: Vectra REST API Version 3.1 - Accounts
    x-displayName: Accounts
  - name: v3.1/assignments
    description: Vectra REST API Version 3.1 - Assignments 
    x-displayName: Assignments
  - name: v3.1/assignment_outcomes
    description: Vectra REST API Version 3.1 - Assignment Outcomes 
    x-displayName: Assignment Outcomes
  - name: v3.1/detections
    description: Vectra REST API Version 3.1 - Detections 
    x-displayName: Detections
  - name: v3.1/entities
    description: Vectra REST API Version 3.1 - Entities 
    x-displayName: Entities
  - name: v3.1/events
    description: Vectra REST API Version 3.1 - Events 
    x-displayName: Events
  - name: v3.1/notes
    description: Vectra REST API Version 3.1 - Notes
    x-displayName: Notes
  - name: v3.1/rules
    description: Vectra REST API Version 3.1 - Triage Rules 
    x-displayName: Triage Rules
  - name: v3.1/tagging
    description: Vectra REST API Version 3.1 - Tagging 
    x-displayName: Tagging  

  # V3
  - name: v3/accounts
    description: Vectra REST API Version 3 - Accounts
    x-displayName: Accounts
  - name: v3/assignments
    description: Vectra REST API Version 3 - Assignments 
    x-displayName: Assignments
  - name: v3/assignment_outcomes
    description: Vectra REST API Version 3 - Assignment Outcomes 
    x-displayName: Assignment Outcomes
  - name: v3/detections
    description: Vectra REST API Version 3 - Detections 
    x-displayName: Detections
  - name: v3/events
    description: Vectra REST API Version 3 - Events 
    x-displayName: Events
  - name: v3/notes
    description: Vectra REST API Version 3 - Notes
    x-displayName: Notes
  - name: v3/rules
    description: Vectra REST API Version 3 - Triage Rules 
    x-displayName: Triage Rules
  - name: v3/tagging
    description: Vectra REST API Version 3 - Tagging 
    x-displayName: Tagging  
components:
  parameters:
    Common:
      ordering:
        name: ordering
        description: Which field to use when ordering the results.
        in: query
        required: false
        type: string
      page:
        name: page
        description: A page number within the paginated result set.
        in: query
        required: false
        type: integer
      page_size:
        name: page_size
        description: Number of results to return per page.
        in: query
        required: false
        type: integer
    UniqueHostObservedAuditListParamsV3_4:
      page:
        description: A page number within the paginated result set.
        in: query
        name: page
        required: false
        type: integer
        example: 5
        minimum: 1
      page_size:
        description: Number of results to return per page.
        in: query
        name: page_size
        required: false
        type: integer
        minimum: 1
        example: 10
    UniqueHostObservedListParamsV3_4:
      start:
        name: start
        type: string
        in: query
        format: date-time
        description: Starting month of data list.
        example: '2024-11'
      end: 
        name: end
        in: query
        type: string
        format: date-time
        description: Ending month of data list.
        example: '2025-01'
      offset:  
        name: offset
        in: query
        type: string
        description: |
          The timezone offset applied to the start and end dates queried for host counts. 
          The value must be in ISO 8601 format (+HHMM or -HHMM), representing the difference from UTC.  
        example: '+0500'
    LockdownListParamsV3_3:
      entity_type:  
        description: Filter on entity type in lockdown mode.
        enum:
        - account
        - host
        - account,host
        - host,account
        in: query
        name: entity_type
        required: false
        type: string
        example: account
      type: 
        description: Filter on entity type in lockdown mode.
        enum:
        - account
        - host
        - account,host
        - host,account
        in: query
        name: type
        required: false
        type: string
        example: account
    UsersListParamsV3_4:
      role:  
        description: Filter on user role. Use the role snake-case standardized name.
        in: query
        name: role
        required: false
        type: string
        example: "super_admins"
      email:  
        description: Filter on a user email.
        in: query
        name: email
        required: false
        type: string
        example: email@domain.com
    UsersListParamsV3_3:
      page:
        description: A page number within the paginated result set.
        in: query
        name: page
        required: false
        type: integer
        example: 5
        minimum: 1
      page_size:
        description: Number of results to return per page.
        in: query
        name: page_size
        required: false
        type: integer
        minimum: 1
        example: 10
      username:
        description: Filter on user username.
        in: query
        name: username
        required: false
        type: string
        example: email@domain.com
      role:
        description: Filter on user role. Use the role's human-readable name.
        in: query
        name: role
        required: false
        type: string
        example: Read-Only
      account_type:
        description: Filter on user account type.
        in: query
        name: account_type
        required: false
        type: string
        example: JWT
      authentication_profile:
        description: Filter on user authentication profile name.
        in: query
        name: authentication_profile
        required: false
        type: string
        example: TACACS_Admin_Access
      last_login_gte:
        description: Filter on users with a last login timestamp on or after the provided
          value.
        format: date-time
        in: query
        name: last_login_gte
        required: false
        type: string
        example: "2025-03-06T16:00:00Z" 
    EventsAccountDetectionsListParamsV3:
      account_uid:
        description: Filter on events based on their related account uid.
        in: query
        name: account_uid
        required: false
        type: string
      detection_id:
        description: Filter on a detection id.
        in: query
        name: detection_id
        required: false
        type: integer
      event_timestamp_gte:
        description: Filter on event timestamps greater than or equal to the provided
          time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z).
        format: date-time
        in: query
        name: event_timestamp_gte
        required: false
        type: string
      from:
        description: Filter to provide a checkpoint for event ids. Depending on ordering scheme,
          returns ids greater than or less than the value, inclusive.
        in: query
        name: from
        required: false
        type: integer
      include_info_category:
        description: Flag to include detection events wih info category.
        in: query
        name: include_info_category
        required: false
        type: boolean
      include_triaged:
        description: Flag to include detection events that have been triaged.
        in: query
        name: include_triaged
        required: false
        type: boolean
      limit:
        description: Specify the batch size returned. By default 500 events are returned.
        in: query
        maximum: 1000
        name: limit
        required: false
        type: integer
      ordering:
        description: Flag to order events by event timestamp. The default sorts events
          by ascending timestamps.
        enum:
        - event_timestamp
        - -event_timestamp
        in: query
        name: ordering
        required: false
        type: string
      since:
        description: Filter to provide a checkpoint for event ids. Depending on ordering
          scheme, returns ids greater than, or returns ids less than the provided
          value.
        in: query
        name: since
        required: false
        type: integer
    EventsAccountScoringListParamsV3:
      account_uid:
        description: Filter on events based on their related account uid.
        in: query
        name: account_uid
        required: false
        type: string
      event_timestamp_gte:
        description: Filter on event timestamps greater than or equal to the provided
          time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z).
        format: date-time
        in: query
        name: event_timestamp_gte
        required: false
        type: string
      from:
        description: Filter to provide a checkpoint for event ids. Depending on ordering scheme,
          returns ids greater than or less than the value, inclusive.
        in: query
        name: from
        required: false
        type: integer
      include_score_decreases:
        description: Flag to include events reflecting score decreases.
        in: query
        name: include_score_decreases
        required: false
        type: boolean
      limit:
        description: Specify the batch size returned. By default 500 events are returned.
        in: query
        maximum: 1000
        name: limit
        required: false
        type: integer
      since:
        description: Filter to provide a checkpoint for event ids. Depending on ordering
          scheme, returns ids greater than, or returns ids less than the provided. Deprecated after V3.0.
          If 'from' is also provided, 
          value.
        in: query
        name: since
        required: false
        type: integer
      ordering:
        description: Flag to order events by event timestamp. The default sorts events
          by ascending timestamps.
        enum:
        - event_timestamp
        - -event_timestamp
        in: query
        name: ordering
        required: false
        type: string
    EventsAuditsListParamsV3:
      event_timestamp_gte:
        description: Filter on event timestamps greater than or equal to the provided
          time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z).
        format: date-time
        in: query
        name: event_timestamp_gte
        required: false
        type: string
      event_timestamp_lte:
        description: Filter on event timestamps less than or equal to the provided
          time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z).
        format: date-time
        in: query
        name: event_timestamp_lte
        required: false
        type: string
      from:
        description: Filter to provide a checkpoint for event ids. Depending on ordering scheme,
          returns ids greater than or less than the value, inclusive.
        in: query
        name: from
        required: false
        type: integer
      user_id:
        description: Filter on events associated with a particular user id.
        in: query
        name: user_id
        required: false
        type: string
      event_object:
        description: Filter on events associated with a particular object. (e.g. account,
          user, host, etc.)
        in: query
        name: event_object
        required: false
        type: string
      event_action:
        description: Filter on events associated with a particular action. (e.g. delete,
          create, etc.)
        in: query
        name: event_action
        required: false
        type: string
      limit:
        description: Specify the batch size returned. By default 500 events are returned.
        in: query
        name: limit
        required: false
        type: integer
      ordering:
        description: Flag to order events by event timestamp. The default sorts events
          by ascending timestamps.
        enum:
        - event_timestamp
        - -event_timestamp
        in: query
        name: ordering
        required: false
        type: string
    EventsDetectionsListParamsV3_3:
      event_timestamp_gte:
        description: Filter on event timestamps greater than or equal to the provided
          time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z).
        format: date-time
        in: query
        name: event_timestamp_gte
        required: false
        type: string
      event_timestamp_lte:
        description: Filter on event timestamps less than or equal to the provided
          time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z).
        format: date-time
        in: query
        name: event_timestamp_lte
        required: false
        type: string
      from:
        description: Filter to provide a checkpoint for event ids. Depending on ordering scheme,
          returns ids greater than or less than the value, inclusive.
        in: query
        name: from
        required: false
        type: integer
      include_triaged:
        description: Flag to include detection events that have been triaged.
        in: query
        name: include_triaged
        required: false
        type: boolean
      include_info_category:
        description: Flag to include detection events of category type 'info'.
        in: query
        name: include_info_category
        required: false
        type: boolean
      limit:
        description: Specify the batch size returned. By default 500 events are returned.
        in: query
        maximum: 1000
        name: limit
        required: false
        type: integer
      entity_type:
        description: Filter on events based on their related entity.
        enum:
        - host
        - account
        - account,host
        - host,account
        in: query
        name: entity_type
        required: false
        type: string
      detection_id:
        description: Filter on a detection id.
        in: query
        name: detection_id
        required: false
        type: integer
      id:
        description: Filter on a event id.
        in: query
        name: id
        required: false
        type: integer
      type:
        description: Filter on events based on their related entity.
        enum:
        - host
        - account
        - account,host
        - host,account
        in: query
        name: type
        required: false
        type: string
      account_uid:
        description: Filter on events based on their related account uid.
        in: query
        name: account_uid
        required: false
        type: string
      ordering:
        description: Flag to order events by event timestamp. The default sorts events
          by ascending timestamps.
        enum:
        - event_timestamp
        - -event_timestamp
        in: query
        name: ordering
        required: false
        type: string
    EventsEntityScoringListParamsV3_1:
      event_timestamp_gte:
        description: Filter on event timestamps greater than or equal to the provided
          time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z)
        format: date-time
        in: query
        name: event_timestamp_gte
        required: false
        type: string
      from:
        description: Filter to provide a checkpoint for event ids. Depending on ordering scheme,
          returns ids greater than or less than the value, inclusive.
        in: query
        name: from
        required: false
        type: integer
      include_score_decreases:
        description: Flag to include events reflecting score decreases.
        in: query
        name: include_score_decreases
        required: false
        type: boolean
      limit:
        description: Specify the batch size returned. By default 500 events are returned.
        in: query
        maximum: 1000
        name: limit
        required: false
        type: integer
      ordering:
        description: Flag to order events by event timestamp. The default sorts events
          by ascending timestamps.
        enum:
        - event_timestamp
        - -event_timestamp
        in: query
        name: ordering
        required: false
        type: string
    EventsEntityScoringListParamsV3_3:
      event_timestamp_gte:
        description: Filter on event timestamps greater than or equal to the provided
          time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z)
        format: date-time
        in: query
        name: event_timestamp_gte
        required: false
        type: string
      event_timestamp_lte:
        description: Filter on event timestamps less than or equal to the provided
          time. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z)
        format: date-time
        in: query
        name: event_timestamp_lte
        required: false
        type: string
      from:
        description: Filter to provide a checkpoint for event ids. Depending on ordering scheme,
          returns ids greater than or less than the value, inclusive.
        in: query
        name: from
        required: false
        type: integer
      include_score_decreases:
        description: Flag to include events reflecting score decreases.
        in: query
        name: include_score_decreases
        required: false
        type: boolean
      entity_type:
        description: Filter on events based on their related entity. Either entity_type
          or type is required.
        enum:
        - host
        - account
        in: query
        name: entity_type
        required: false
        type: string
      type:
        description: Filter on events based on their related entity. Either entity_type
          or type is required.
        enum:
        - host
        - account
        in: query
        name: type
        required: false
        type: string
      limit:
        description: Specify the batch size returned. By default 500 events are returned.
        in: query
        maximum: 1000
        name: limit
        required: false
        type: integer
      ordering:
        description: Flag to order events by event timestamp. The default sorts events
          by ascending timestamps.
        enum:
        - event_timestamp
        - -event_timestamp
        in: query
        name: ordering
        required: false
        type: string
    EntitiesReadParamsV3_4:
      type:
        description: Filter on the entity type to return.
        enum:
        - account
        - host
        in: query
        name: type
        required: true
        type: string
        example: account
    EntitiesReadParamsV3_3:
      type:
        description: Filter on the entity type to return. The user is required to provide the parameter entity_type or type.
        enum:
        - account
        - host
        in: query
        name: type
        required: false
        type: string
        example: account
      entity_type:
        description: Filter on the entity type to return. The user is required to provide the parameter entity_type or type.
        enum:
        - account
        - host
        in: query
        name: entity_type
        required: false
        type: string
        example: account
    EntitiesReadParamsV3_1:
      entity_type:
        description: Filter on the entity type to return.
        enum:
        - account
        - host
        in: query
        name: entity_type
        required: true
        type: string
        example: account
    EntitiesListParamsV3_4:
      fields:
        description: Fields to include in the response object.  This accepts a comma-separated list.
        in: query
        name: fields
        required: false
        enum:
        - "id"
        - "name"
        - "breadth_contrib"
        - "importance"
        - "type"
        - "is_prioritized"
        - "severity"
        - "urgency_score"
        - "velocity_contrib"
        - "detection_set"
        - "last_detection_timestamp"
        - "last_modified_timestamp"
        - "notes"
        - "attack_rating"
        - "privilege_level"
        - "privilege_category"
        - "attack_profile"
        - "sensors"
        - "state"
        - "tags"
        - "url"
        - "host_type"
        - "account_type"
        - "ip"
        example: 'name,id'
      exclude_fields:
        description: Fields to exclude in the response object. This accepts a comma-separated list.
        in: query
        name: exclude_fields
        required: false
        enum:
        - "id"
        - "name"
        - "breadth_contrib"
        - "importance"
        - "type"
        - "is_prioritized"
        - "severity"
        - "urgency_score"
        - "velocity_contrib"
        - "detection_set"
        - "last_detection_timestamp"
        - "last_modified_timestamp"
        - "notes"
        - "attack_rating"
        - "privilege_level"
        - "privilege_category"
        - "attack_profile"
        - "sensors"
        - "state"
        - "tags"
        - "url"
        - "host_type"
        - "account_type"
        - "ip"
        example: 'name,id'
    EntitiesListParamsV3_3:
      type:
        description: Filter on the entity type to return.
        enum:
        - account
        - host
        in: query
        name: type
        required: false
        type: string
        example: account
      last_modified_timestamp_gte:
        description: Filter on entities which have a last modified timestamp on or
          after the provided value.
        in: query
        name: last_modified_timestamp_gte
        required: false
        type: string
        format: date-time
        example: '2025-03-03T10:46:38Z'
      last_modified_timestamp_lte:
        description: Filter on entities which have a last modified timestamp on or
          before the provided value.
        in: query
        name: last_modified_timestamp_lte
        required: false
        type: string
        format: date-time
        example: '2025-03-03T10:46:38Z'
      last_detection_timestamp_lte:
        description: Filter on entities which have a last detection timestamp on or
          before the provided value.
        in: query
        name: last_detection_timestamp_lte
        required: false
        type: string
        format: date-times
        example: '2025-03-03T10:46:38Z'
      fields:
        description: Fields to include in the response object.  This accepts a comma-separated list.
        in: query
        name: fields
        required: false
        enum:
        - "id"
        - "name"
        - "breadth_contrib"
        - "entity_importance"
        - "importance"
        - "entity_type"
        - "type"
        - "is_prioritized"
        - "severity"
        - "urgency_score"
        - "velocity_contrib"
        - "detection_set"
        - "last_detection_timestamp"
        - "last_modified_timestamp"
        - "notes"
        - "attack_rating"
        - "privilege_level"
        - "privilege_category"
        - "attack_profile"
        - "sensors"
        - "state"
        - "tags"
        - "url"
        - "host_type"
        - "account_type"
        - "ip"
        example: 'name,id'
      exclude_fields:
        description: Fields to exclude in the response object. This accepts a comma-separated list.
        in: query
        name: exclude_fields
        required: false
        enum:
        - "id"
        - "name"
        - "breadth_contrib"
        - "entity_importance"
        - "importance"
        - "entity_type"
        - "type"
        - "is_prioritized"
        - "severity"
        - "urgency_score"
        - "velocity_contrib"
        - "detection_set"
        - "last_detection_timestamp"
        - "last_modified_timestamp"
        - "notes"
        - "attack_rating"
        - "privilege_level"
        - "privilege_category"
        - "attack_profile"
        - "sensors"
        - "state"
        - "tags"
        - "url"
        - "host_type"
        - "account_type"
        - "ip"
        example: 'name,id'
    EntitiesListParamsV3_1:
      ordering:
        description: Option to order the records by last timestamp, last_modified_timestamp, name, and/or priority score. 
          By default the results are sorted by urgency score in descending order. 
          Multi-ordering is supported by sending a comma-separated list of fields. Sort in descending order by prepending the query with “minus” symbol.
        in: query
        name: ordering
        required: false
        type: string
        example: "urgency_score,-name"
      page:  
        description: A page number within the paginated result set.
        in: query
        name: page
        required: false
        type: integer
        minimum: 1
        example: 5
      page_size:  
        description: Number of results to return per page.
        in: query
        name: page_size
        required: false
        type: integer
        minimum: 1
        maximum: 5000
        example: 10
      id: 
        description: Filter on id values provided. Accepts comma-separated list.
        in: query
        name: id
        required: false
        type: string
        example: "1.20"
      is_prioritized:
        description: Filter on entities whos priority score is above the configured
          priority threashold.
        in: query
        name: is_prioritized
        required: false
        type: boolean
        example: false
      entity_type:
        description: Filter on the entity type to return.
        enum:
        - account
        - host
        in: query
        name: entity_type
        required: false
        type: string
        example: account
      last_detection_timestamp_gte:
        description: Filter on entities which have a last detection timestamp on or
          after the provided value.
        format: date-time
        in: query
        name: last_detection_timestamp_gte
        required: false
        type: string
        example: '2025-03-06T15:46:38Z'
      fields:
        description: Fields to include in the response object.  This accepts a comma-separated list.
        in: query
        name: fields
        required: false
        enum:
        - 'id'
        - 'breadth_contrib'
        - 'entity_importance'
        - 'is_prioritized'
        - 'severity'
        - 'urgency_score'
        - 'velocity_contrib'
        - 'detection_set'
        - 'last_detection_timestamp'
        - 'name'
        - 'notes'
        - 'privilege_level'
        - 'privilege_category'
        - 'sensors'
        - 'state'
        - 'tags'
        - 'url'
        - 'account_type'
        - 'entity_type'
        example: 'name,id'
      exclude_fields:
        description: Fields to exclude in the response object. This accepts a comma-separated list.
        in: query
        name: exclude_fields
        required: false
        enum:
        - 'id'
        - 'breadth_contrib'
        - 'entity_importance'
        - 'is_prioritized'
        - 'severity'
        - 'urgency_score'
        - 'velocity_contrib'
        - 'detection_set'
        - 'last_detection_timestamp'
        - 'name'
        - 'notes'
        - 'privilege_level'
        - 'privilege_category'
        - 'sensors'
        - 'state'
        - 'tags'
        - 'url'
        - 'account_type'
        example: 'name,id'
      name:
        description: Filter on entity name.
        in: query
        name: name
        required: false
        type: string
        example: "email@domain.com"
      note_modified_timestamp_gte:
        description: Filter on entities which have a note modified timestamp on or
          after the provided value.
        format: date-time
        in: query
        name: note_modified_timestamp_gte
        required: false
        type: string
        example: '2025-03-03T10:46:38Z'
      state:
        description: Filter on entity activation state.
        enum:
        - active
        - inactive
        in: query
        name: state
        required: false
        type: string
        example: active
      tags:
        description: Filter on entities that contain any of the provided tags. Accepts
          comma-separated list.
        in: query
        name: tags
        required: false
        type: string 
        example: 'foo,bar'
    DetectionsParamsV3:
      ordering:
        name: ordering
        description: Which field to use when ordering the results.
        in: query
        required: false
        type: string
      page:
        name: page
        description: A page number within the paginated result set.
        in: query
        required: false
        type: integer
      page_size:
        name: page_size
        description: Number of results to return per page.
        in: query
        required: false
        type: integer
      category:
        name: category
        description: Filter on detection category.
        in: query
        required: false
        type: string
      certainty:
        name: certainty
        description: Filter on certainty score.
        in: query
        required: false
        type: integer
      certainty_gte:
        name: certainty_gte
        description: Filter on certainty score greater than or equal to this value.
        in: query
        required: false
        type: integer
      c_score:
        name: c_score
        description: Filter on certainty score.
        in: query
        required: false
        type: integer
      c_score_gte: 
        name: c_score_gte
        description: Filter on certainty score greater than or equal to this value.
        in: query
        required: false
        type: integer
      description:
        name: description
        description: Filter on descriptions containing this value.
        in: query
        required: false
        type: string
      detection:
        name: detection
        description: Filter on detection name.
        in: query
        required: false
        type: string
      detection_type:
        name: detection_type
        description: Filter on detection name.
        in: query
        required: false
        type: string
      detection_category:
        name: detection_category
        description: |
          Filter on detections category. Partial word match is supported, for example: /detections?detection_category=recon
        in: query
        required: false
        type: string
      exclude_fields:
        name: exclude_fields
        description: Fields to exclude in the response object.
        enum:
        - id
        - assigned_to
        - assigned_date
        - c_score
        - category
        - certainty
        - created_timestamp
        - custom_detection
        - description
        - detection
        - detection_category
        - detection_type
        - detection_url
        - groups
        - first_timestamp
        - last_timestamp
        - is_custom_model
        - is_marked_custom
        - is_targeting_key_asset
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - src_account
        - src_host
        - src_ip
        - state
        - t_score
        - tags
        - targets_key_asset
        - threat
        - triage_rule_id
        - url
        in: query
        required: false
        type: string
      fields:
        name: fields
        description: Fields to include in the response object.
        enum:
        - id
        - url
        - detection_url
        - category
        - detection
        - detection_category
        - detection_type
        - custom_detection
        - description
        - src_ip
        - state
        - t_score
        - c_score
        - certainty
        - threat
        - created_timestamp
        - first_timestamp
        - last_timestamp
        - targets_key_asset
        - is_targeting_key_asset
        - src_account
        - src_host
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - tags
        - triage_rule_id
        - assigned_to
        - assigned_date
        - groups
        - is_marked_custom
        - is_custom_model
        - grouped_details
        - summary
        - reason
        in: query
        required: false
        type: string
      host_id:
        name: host_id
        description: Filter on host id attributed to a detection.
        in: query
        required: false
        type: integer
      id: 
        name: id
        description: Filter on id values provided. Accepts comma-separated list.
        in: query
        required: false
        type: string
      is_targeting_key_asset:
        name: is_targeting_key_asset
        description: Filter on detections targeting a key asset.
        in: query
        required: false
        type: boolean
      is_triaged:
        name: is_triaged
        description: Filter on detections with associated Triage Rules.
        in: query
        required: false
        type: boolean
      last_timestamp:
        name: last_timestamp
        description: Filter on the time when the event was last detected.
        format: date-time
        in: query
        required: false
        type: string
      last_timestamp_gte:
        name: last_timestamp_gte
        description: Filter on detections last detected on or after the provided time.
        format: date-time
        in: query
        required: false
        type: string
      min_id: 
        name: min_id
        description: Filter on ids greater than or equal to min_id.
        in: query
        required: false
        type: integer
      max_id:
        name: max_id
        description: Filter on ids less than or equal to max_id.
        in: query
        required: false
        type: integer
      note_modified_timestamp_gte:
        name: note_modified_timestamp_gte
        description: Filter on detections with modified notes on or before the provided
          time.
        format: date-time
        in: query
        required: false
        type: string
      src_account:
        name: src_account
        description: Filter on detections associated with a certain account.
        in: query
        required: false
        type: integer
      src_ip:
        name: src_ip
        description: Filter on detection source IP address.
        in: query
        required: false
        type: string
        format: ipv4
      state:
        description: Filter on detection state.
        in: query
        name: state
        required: false
        type: string
      tags:
        name: tags
        description: Filter on detection tags. Accepts comma-separated list.
        in: query
        required: false
        type: string
      targets_key_asset:
        name: targets_key_asset
        description: Filter on detections targeting a key asset.
        in: query
        required: false
        type: boolean
      threat:
        name: threat
        description: Filter on threat score.
        in: query
        required: false
        type: integer
      threat_gte:
        name: threat_gte
        description: Filter on threat score greater than or equal to this value.
        in: query
        required: false
        type: integer
      t_score:
        name: t_score
        description: Filter on threat score.
        in: query
        required: false
        type: integer
      t_score_gte:
        name: t_score_gte
        description: Filter on threat score greater than or equal to this value.
        in: query
        required: false
        type: integer
    DetectionsParamsV3.3:
      canonicalize:
        name: canonicalize
        description: |
          Flag to return the response in canonical JSON format.
          Note: JSON makes no guarantees on order and response fields may be reordered in transit. 
          If there are any problems, a non-canonicalized response is returned.
        in: query
        required: false
        type: boolean
      created_timestamp_gte:
        name: created_timestamp_gte
        format: date-time
        description: Filter on detections created on or after this value.
        in: query
        required: false
        type: string
      created_timestamp_lte: 
        name: created_timestamp_lte
        format: date-time
        description: Filter on detections created on or before this value.
        in: query
        required: false
        type: string
      entity_id:
        name: entity_id
        description: Filter on entity id (account or host).
        in: query
        required: false
        type: integer
      exclude_fields:
        name: exclude_fields
        description: Fields to exclude in the response object.
        enum:
        - id
        - assigned_to
        - assigned_date
        - c_score
        - category
        - certainty
        - created_timestamp
        - custom_detection
        - description
        - detection
        - detection_category
        - detection_type
        - detection_url
        - groups
        - filtered_by_rule
        - filtered_by_ai
        - filtered_by_user
        - first_timestamp
        - last_timestamp
        - is_custom_model
        - is_marked_custom
        - is_targeting_key_asset
        - is_triaged
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - sensor
        - sensor_name
        - src_account
        - src_host
        - src_ip
        - state
        - t_score
        - tags
        - targets_key_asset
        - threat
        - triage_rule_id
        - type
        - url
        in: query
        required: false
        type: string
      last_timestamp_lte:
        name: last_timestamp_lte
        format: date-time
        description: Filter on detections last detected on or before the provided
        in: query
        required: false
        type: string
      src_account:
        name: src_account
        description: Filter on detections associated with a certain account.
        in: query
        required: false
        type: integer
      src_account_id:
        name: src_account_id
        description: Filter on detections associated with a certain account.
        in: query
        required: false
        type: integer
      type:
        name: type
        description: Filter on detection associated entity type.
        enum:
        - host
        - account
        in: query
        required: false
        type: string
    DetectionsParamsV3.4:
      exclude_fields:
        name: exclude_fields
        description: Fields to exclude in the response object.
        enum:
        - id
        - assigned_to
        - assigned_date
        - certainty
        - created_timestamp
        - custom_detection
        - data_source
        - description
        - detection
        - detection_category
        - detection_type
        - detection_url
        - groups
        - filtered_by_rule
        - filtered_by_ai
        - filtered_by_user
        - first_timestamp
        - last_timestamp
        - is_custom_model
        - is_marked_custom
        - is_targeting_key_asset
        - is_triaged
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - reason
        - sensor
        - sensor_name
        - src_account
        - src_host
        - src_ip
        - state
        - summary
        - tags
        - threat
        - triage_rule_id
        - type
        - url
        in: query
        required: false
        type: string
      include_info_category:
        name: include_info_category
        description: Include detections of the INFO category which are excluded by default.
        in: query
        required: false
        type: boolean
      reason:
        name: reason
        description: Reason the detection was closed
        in: query
        enum:
        - benign
        - remediated
    AccountsListParamsV3:
      ordering:
        description: |
          Orders records by last timestamp, threat score and certainty score.
          The default out sorts threat and certainty score in ascending order.
          Accounts can be sorted in descending order by prepending the query with “minus” symbol.
        in: query
        name: ordering
        required: false
        type: string
        example: "-last_seen"
      page:
        description: A page number within the paginated result set.
        in: query
        name: page
        required: false
        type: integer
        minimum: 1
        example: 5
      page_size:
        description: Number of results to return per page.
        in: query
        name: page_size
        required: false
        type: integer
        minimum: 1
        maximum: 5000
        example: 10
      all:
        description: No filter, return all Account objects.
        in: query
        name: all
        required: false
        type: boolean
        example: false
      certainty:
        description: Filter on account certainty score.
        in: query
        name: certainty
        required: false
        type: integer
        example: 10
        minimum: 0
      certainty_gte:
        description: Filter on account certainty greater than or equal.
        in: query
        name: certainty_gte
        required: false
        type: integer
        example: 10
        minimum: 0
      c_score:
        description: Filter on account certainty score.
        in: query
        name: c_score
        required: false
        type: integer
        example: 10
        minimum: 0
      c_score_gte:
        description: Filter on account certainty score greater than or equal.
        in: query
        name: c_score_gte
        required: false
        type: integer
        example: 10
        minimum: 0
      exclude_fields:
        description: Fields to exclude in the response object. This accepts a comma-separated list.
        enum:
        - id
        - url
        - name
        - state
        - threat
        - certainty
        - severity
        - account_type
        - tags
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - privilege_level
        - privilege_category
        - last_detection_timestamp
        - detection_set
        - probable_home
        in: query
        name: exclude_fields
        required: false
        type: string
        example: state,name
      fields:
        description: Fields to include in the response object. This accepts a comma-separated list.
        enum:
        - id
        - url
        - name
        - state
        - threat
        - certainty
        - severity
        - account_type
        - tags
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - privilege_level
        - privilege_category
        - last_detection_timestamp
        - detection_set
        - probable_home
        - detection_summaries
        in: query
        name: fields
        required: false
        type: string
        example: state,name
      first_seen:
        description: Filter on the time the account was first seen.
        format: date-time
        in: query
        name: first_seen
        required: false
        type: string
        example: '2025-03-06T15:46:38Z'
      id:
        description: Filter on id values provided. This accepts a comma-separated list.
        in: query
        name: id
        required: false
        type: string
        example: 100,20
      include_detection_summaries:
        description: Flag to include detection summaries in the response.
        in: query
        name: include_detection_summaries
        required: false
        type: boolean
        example: false
      last_detection_timestamp_gte:
        description: Filter on accounts with last detection timestamp greater than
          or equal to the provided time.
        format: date-time
        in: query
        name: last_detection_timestamp_gte
        required: false
        type: string
        example: '2025-03-03T10:46:12Z'
      last_detection_timestamp_lte:
        description: Filter on accounts with last detection timestamp less than or
          equal to the provided time.
        format: date-time
        in: query
        name: last_detection_timestamp_lte
        required: false
        type: string
        example: '2025-03-03T10:46:12Z'
      last_seen:
        description: Filter on the time the account was last seen.
        format: date-time
        in: query
        name: last_seen
        required: false
        type: string
        example: '2025-03-03T10:46:38Z'
      last_source:
        description: Filter against the ID of the account.
        format: ipv4
        in: query
        name: last_source
        required: false
        type: string
        example: 192.0.2.123
      min_id:
        description: Filter on ids greater than or equal to min_id.
        in: query
        name: min_id
        required: false
        type: integer
        example: 2
        minimum: 1
      max_id:
        description: Filter on ids less than or equal to max_id.
        in: query
        name: max_id
        required: false
        type: integer
        example: 100
        minimum: 1
      name:
        description: Filter by name.
        in: query
        name: name
        required: false
        type: string
        example: "email@domain.com" 
      note_modified_timestamp_gte:
        description: Filter by notes modified at timestamps greater than or equal
          to the given timestamp.
        format: date-time
        in: query
        name: note_modified_timestamp_gte
        required: false
        type: string
        example: '2025-03-03T10:46:38Z'
      privilege_category:
        description: Filter on privilege category.
        enum:
        - low
        - medium
        - high
        in: query
        name: privilege_category
        required: false
        type: string
        example: low
      privilege_level:
        description: Filter on privilege level.
        in: query
        name: privilege_level
        required: false
        type: integer
        example: 1
        minimum: 1
      privilege_level_gte:
        description: Filter on privilege level greater than or equal to this value.
        in: query
        name: privilege_level_gte
        required: false
        type: integer
        example: 1
        minimum: 1
      state:
        description: Filter by state.
        enum:
        - active
        - inactive
        in: query
        name: state
        required: false
        type: string
        example: active
      tags:
        description: Filter Accounts with any tag specified in a comma-separated list of tags.
        in: query
        name: tags
        required: false
        type: string
        example: 'foo,bar'
      threat:
        description: Filter on threat score.
        in: query
        name: threat
        required: false
        type: integer
        example: 20
        minimum: 0
      threat_gte:
        description: Filter on threat score greater than or equal to this value.
        in: query
        name: threat_gte
        required: false
        type: integer
        example: 20
        minimum: 0
      t_score:
        description: Filter on threat score.
        in: query
        name: t_score
        required: false
        type: integer
        example: 20
        minimum: 0
      t_score_gte:
        description: Filter on threat score greater than or equal to this value.
        in: query
        name: t_score_gte
        required: false
        type: integer
        example: 20
        minimum: 0 
      uid:
        description: Filter on account uid.
        in: query
        name: uid
        required: false
        type: string
        example: "email@domain.com"
    AccountsReadParamsV3:
        exclude_fields: 
          description: Fields to exclude in the response object. This accepts a comma-separated list.
          enum:
          - id
          - url
          - name
          - state
          - threat
          - certainty
          - severity
          - account_type
          - tags
          - note
          - notes
          - note_modified_by
          - note_modified_timestamp
          - privilege_level
          - privilege_category
          - last_detection_timestamp
          - detection_set
          - probable_home
          in: query
          name: exclude_fields
          required: false
          type: string
          example: state,name
        fields:
          description: Fields to include in the response object. This accepts a comma-separated list.
          enum:
          - id
          - url
          - name
          - state
          - threat
          - certainty
          - severity
          - account_type
          - tags
          - note
          - notes
          - note_modified_by
          - note_modified_timestamp
          - privilege_level
          - privilege_category
          - last_detection_timestamp
          - detection_set
          - probable_home
          - detection_summaries
          - note_modified_by
          - url
          - ldap
          in: query
          name: fields
          required: false
          type: string
          example: state,name
        include_external:  
          description: Flag to include all account context details in the response object. 
            This populates the ldap response field only when the param is set to true.
          in: query
          name: include_external
          required: false
          type: boolean
          example: false
        include_access_history: 
          description: Flag to include account access history in the response object. This is true by default.
          in: query
          name: include_access_history
          required: false
          type: boolean
          example: false
        include_detection_summaries:  
          description: Flag to include detection summaries in the response.
          in: query
          name: include_detection_summaries
          required: false
          type: boolean
          example: false
        src_linked_account: 
          description: Flag to include a list of uuids for sub accounts under the name
            field.
          in: query
          name: src_linked_account
          required: false
          type: boolean
          example: false
        note_modified_by:
          description: 
          in: query
          name: note_modified_by
          required: false
          type: string
          example: API Client 1234
    GroupsListParamsV3_4:
        domains:
          description: |
            Filter on groups containing at least one of the listed domains.
            Only valid when the 'type' parameter is set to domain. Accepts comma-separated
            list.
          in: query
          name: domains
          required: false
          type: string
        host_ids:
          description: |
            Filter on groups containing at least one of the listed host ids.
            Only valid when the 'type' parameter is set to host. Accepts comma-separated
            list.
          in: query
          name: host_ids
          required: false
          type: string
        include_members:
          description: |
            Flag to include members in the response object. Regex groups may return many members.
            By default this is true.
          in: query
          name: include_members
          required: false
          type: boolean
        is_membership_evaluation_ongoing:
          description: |
            Filter on groups with ongoing membership evaluation.
          in: query
          name: is_membership_evaluation_ongoing
          required: false
          type: boolean
        is_regex:
          description: |
            Filters on Regex Groups.
          in: query
          name: is_regex
          required: false
          type: boolean
        host_names:
          description: |
            Filter on groups containing at least one of the listed host names.
            Only valid when the 'type' parameter is set to host. Accepts comma-separated
            list.
          in: query
          name: host_names
          required: false
          type: string
        ips:
          description: |
            Filter on groups containing at least one of the listed IPs. Only
            valid when the 'type' parameter is set to IP. Accepts comma-separated list.
          in: query
          name: ips
          required: false
          type: string
        type:
          description: Filter on groups by membership type.
          enum:
          - host
          - account
          - domain
          - ip
          in: query
          name: type
          required: false
          type: string
        is_ad_group:
          description: |
            Filter on AD Groups.
          in: query
          name: is_ad_group
          required: false
          type: boolean
        ad_group_dn:
          description: |
            Filter on AD Group distinguished names.
          in: query
          name: ad_group_dn
          required: false
          type: string
    GroupsListParamsV3_2:
        ordering:  
          description: |
            Option to order the records by last timestamp and/or priority score. By default the results are sorted by urgency score in descending order.
            Multi-ordering is supported by sending a comma-separated list of fields. Sort in descending order by prepending the query with “minus” symbol.
          in: query
          name: ordering
          required: false
          type: string
          example: urgency_score,-name 
        page:   
          description: A page number within the paginated result set.
          in: query
          name: page
          required: false
          type: integer
        page_size:
          description: Number of results to return per page.
          name: page_size
          in: query
          required: false
          type: integer
        account_ids:
          name: account_ids
          description: Filter on groups containing at least one of the listed account
            ids. Only valid when the 'type' parameter is set to account. Accepts comma-separated list.
          in: query
          required: false
          type: string
        account_names:
          name: account_names
          description: Filter on groups containing at least one of the listed account
            names. Only valid when the 'type' parameter is set to account. Accepts comma
            separated list.
          in: query
          required: false
          type: string
        description:
          name: description
          description: Filter groups based on descriptions containing the provided value.
            (case insensitive match).
          in: query
          required: false
          type: string
        importance:
          name: importance
          description: Filter groups based on importance.
          in: query
          required: false
          type: string
          enum:
          - high
          - medium
          - low
          - never_prioritize
        last_modified_by:
          name: last_modified_by
          description: Filter on groups by the user who made the most recent modification.
          in: query
          required: false
          type: string
        last_modified_timestamp:
          name: last_modified_timestamp
          description: Filter on groups which have a last modified timestamp on or after
            the provided value. (UTC) in ISO-8601 format (ex. 2019-08-27T20:55:29Z).
          format: date-time
          in: query
          required: false
          type: string
        name:
          name: name
          description: Filter on groups by name. This parameter is case insensitive
          in: query
          required: false
          type: string
        type:
          name: type
          description: Filter on groups by membership type.
          enum:
          - account
          in: query
          required: false
          type: string
    HostsListParamsV3_3:
        ordering:  
          description: |
            Option to order the records by last timestamp and/or priority score. By default the results are sorted by urgency score in descending order.
            Multi-ordering is supported by sending a comma-separated list of fields. Sort in descending order by prepending the query with “minus” symbol
          in: query
          name: ordering
          required: false
          type: string
          example: urgency_score,-name
        page:  
          description: A page number within the paginated result set.
          in: query
          name: page
          required: false
          type: integer
          minimum: 1
          example: 5
        page_size: 
          description: Number of results to return per page.
          in: query
          name: page_size
          required: false
          type: integer
          minimum: 1
          maximum: 5000
          example: 10
        active_traffic:  
          description: Filter on hosts that have generated active traffic within the
            last 2 hours.
          in: query
          name: active_traffic
          required: false
          type: boolean
          example: false
        all:  
          description: No filter, return all Host objects.
          in: query
          name: all
          required: false
          type: boolean
          example: false
        all_active:
          description: Exclude hosts with no active host sessions or detections. This can increase the speed of the response in the case of timeouts.
          in: query
          name: all_active
          required: false
          type: boolean
          example: false
        has_active_traffic:
          description: Filter on hosts that are exhibiting active traffic.
          in: query
          name: has_active_traffic
          required: false
          type: boolean
          example: false
        certainty:
          description: Filter on certainty score.
          in: query
          name: certainty
          required: false
          type: integer
          example: 10
          minimum: 0
        certainty_gte:
          description: Filter on certainty score greater than or equal to this value.
          in: query
          name: certainty_gte
          required: false
          type: integer
          example: 10
          minimum: 0
        c_score:
          description: Filter on certainty score.
          in: query
          name: c_score
          required: false
          type: integer
          example: 10
          minimum: 0
        c_score_gte:
          description: Filter on certainty score greater than or equal to this value.
          in: query
          name: c_score_gte
          required: false
          type: integer
          example: 10
          minimum: 0
        exclude_fields:
          description: Fields to exclude in the response object. This accepts a comma-separated list.
          enum:
          - id
          - name
          - active_traffic
          - has_active_traffic
          - t_score
          - threat
          - c_score
          - certainty
          - severity
          - last_source
          - ip
          - previous_ips
          - last_detection_timestamp
          - key_asset
          - is_key_asset
          - state
          - targets_key_asset
          - is_targeting_key_asset
          - detection_set
          - host_artifact_set
          - sensor
          - sensor_name
          - tags
          - note
          - notes
          - note_modified_by
          - note_modified_timestamp
          - url
          - host_url
          - last_modified
          - assigned_to
          - assigned_date
          - groups
          - has_custom_model
          - privilege_level
          - privilege_category
          - probable_owner
          - detection_profile
          - assignment
          - past_assignments
          in: query
          name: exclude_fields
          required: false
          type: string
          example: state,id
        fields:
          description: Fields to include in the response object. This accepts a comma-separated list.
          enum:
          - id
          - name
          - active_traffic
          - has_active_traffic
          - t_score
          - threat
          - c_score
          - certainty
          - severity
          - last_source
          - ip
          - previous_ips
          - last_detection_timestamp
          - key_asset
          - is_key_asset
          - state
          - targets_key_asset
          - is_targeting_key_asset
          - detection_set
          - host_artifact_set
          - sensor
          - sensor_name
          - tags
          - note
          - notes
          - note_modified_by
          - note_modified_timestamp
          - url
          - host_url
          - last_modified
          - assigned_to
          - assigned_date
          - groups
          - has_custom_model
          - privilege_level
          - privilege_category
          - probable_owner
          - detection_profile
          - assignment
          - past_assignments
          - detection_summaries
          - host_session_luids
          - host_luid
          in: query
          name: fields
          required: false
          type: string
          example: state,id
        include_detection_summaries:
          description: Flag to include detection summaries in the response.
          in: query
          name: include_detection_summaries
          required: false
          type: boolean
          example: false
        is_key_asset:
          description: Filter on hosts based on the key asset flag.
          in: query
          name: is_key_asset
          required: false
          type: boolean
          example: false
        is_targeting_key_asset:
          description: Filter on hosts targetting key assets.
          in: query
          name: is_targeting_key_asset
          required: false
          type: boolean
          example: false
        key_asset:
          description: Filter on hosts based on the key asset flag.
          in: query
          name: key_asset
          required: false
          type: boolean
          example: false
        last_detection_timestamp:
          description: Filter on hosts based on last detection timestamp.
          format: date-time
          in: query
          name: last_detection_timestamp
          required: false
          type: string
          example: '2025-03-06T15:46:38Z'
        last_source:
          description: Filter on last source IP associated with a host.
          in: query
          name: last_source
          required: false
          type: string
          example: 100.100.100.100
        mac_address:
          description: Filter on host mac address.
          in: query
          name: mac_address
          required: false
          type: string
          example: "00:45:68:f9:22:b1"
        max_id:
          description: Filter on ids less than or equal to max_id.
          in: query
          name: max_id
          required: false
          type: integer
          example: 100
          minimum: 1
        min_id:
          description: Filter on ids greater than or equal to min_id.
          in: query
          name: min_id
          required: false
          type: integer
          example: 2
          minimum: 1
        name:
          description: Filter on host name.
          in: query
          name: name
          required: false
          type: string
          example: VHE8a543a95cbfeb09ca316xd9fv95b8880
        note_modified_timestamp_gte:
          description: Filter on hosts which have a note modified timestamp on or after
            the provided value.
          format: date-time
          in: query
          name: note_modified_timestamp_gte
          required: false
          type: string
          example: '2025-03-06T15:46:38Z'
        state:
          description: Filter on host activation state.
          enum:
          - active
          - inactive
          in: query
          name: state
          required: false
          type: string
          example: active
        tags:
          description: Filter on hosts that contain any of the provided tags. Accepts
            comma-separated list.
          in: query
          name: tags
          required: false
          type: string
          example: tag1,tag2
        targets_key_asset:
          description: Filter on hosts targetting key assets.
          in: query
          name: targets_key_asset
          required: false
          type: boolean
          example: false
        threat:
          description: Filter on threat score.
          in: query
          name: threat
          required: false
          type: integer
          example: 20
          minimum: 0
        threat_gte:
          description: Filter on threat score greater than or equal to this value.
          in: query
          name: threat_gte
          required: false
          type: integer
          example: 20
          minimum: 0
        t_score:
          description: Filter on threat score.
          in: query
          name: t_score
          required: false
          type: integer
          example: 20
          minimum: 0
        t_score_gte:
          description: Filter on threat score greater than or equal to this value.
          in: query
          name: t_score_gte
          required: false
          type: integer
          example: 20
          minimum: 0
        uuid:
          description: Filter on host uuid.
          in: query
          name: uuid
          required: false
          type: string
        privilege_category:
          description: Filter on privilege category.
          enum:
          - low
          - medium
          - high
          in: query
          name: privilege_category
          required: false
          type: string
          example: low
        privilege_level:
          description: Filter on privilege level.
          in: query
          name: privilege_level
          required: false
          type: integer
          example: 1
          minimum: 1
        privilege_level_gte:
          description: Filter on privilege level greater than or equal to this value.
          in: query
          name: privilege_level_gte
          required: false
          type: integer
          example: 1
          minimum: 1
        last_detection_timestamp_gte:
          description: Filter on hosts with last detection timestamp greater than or
            equal to the provided time.
          format: date-time
          in: query
          name: last_detection_timestamp_gte
          required: false
          type: string
          example: '2025-03-03T10:46:12Z'
        last_detection_timestamp_lte:
          description: Filter on hosts with last detection timestamp less than or equal
            to the provided time.
          format: date-time
          in: query
          name: last_detection_timestamp_lte
          required: false
          type: string
          example: '2025-03-03T10:46:12Z'
    HostsReadParamsV3_3:
      exclude_fields:
        description: Fields to exclude in the response object. This accepts a comma-separated list.
        enum:
        - id
        - name
        - active_traffic
        - has_active_traffic
        - t_score
        - threat
        - c_score
        - certainty
        - severity
        - last_source
        - ip
        - previous_ips
        - last_detection_timestamp
        - key_asset
        - is_key_asset
        - state
        - targets_key_asset
        - is_targeting_key_asset
        - detection_set
        - host_artifact_set
        - sensor
        - sensor_name
        - tags
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - url
        - host_url
        - last_modified
        - assigned_to
        - assigned_date
        - groups
        - has_custom_model
        - privilege_level
        - privilege_category
        - probable_owner
        - detection_profile
        - assignment
        - past_assignments
        in: query
        name: exclude_fields
        required: false
        type: string
        example: state,id
      fields:
        description: Fields to include in the response object. This accepts a comma-separated list.
        enum:
        - id
        - name
        - active_traffic
        - has_active_traffic
        - t_score
        - threat
        - c_score
        - certainty
        - severity
        - last_source
        - ip
        - previous_ips
        - last_detection_timestamp
        - key_asset
        - is_key_asset
        - state
        - targets_key_asset
        - is_targeting_key_asset
        - detection_set
        - host_artifact_set
        - sensor
        - sensor_name
        - tags
        - note
        - notes
        - note_modified_by
        - note_modified_timestamp
        - url
        - host_url
        - last_modified
        - assigned_to
        - assigned_date
        - groups
        - has_custom_model
        - privilege_level
        - privilege_category
        - probable_owner
        - detection_profile
        - assignment
        - past_assignments
        - campaign_summaries
        - detection_summaries
        - has_shell_knocker_learnings
        - last_seen
        - carbon_black
        - vcenter
        - crowdstrike
        - ldap
        - suspicious_admin_learnings
        - shell_knocker
        - host_session_luid
        - host_luid
        in: query
        name: fields
        required: false
        type: string
        example: state,id
      include_external:
        description: Flag to include all host context details in the response object.
        in: query
        name: include_external
        required: false
        type: boolean
        example: false
      include_ldap:
        description: Flag to include information on LDAP servers associated with the
          host.
        in: query
        name: include_ldap
        required: false
        type: boolean
        example: false
      include_access_history:
        description: Flag to include host access history in the response object.
        in: query
        name: include_access_history
        required: false
        type: boolean
        example: false
      include_host_roles:
        description: Flag to include host roles in the response object.
        in: query
        name: include_host_roles
        required: false
        type: boolean
        example: false
      include_edrs:
        description: Flag to include host EDRS in the response object.
        in: query
        name: include_edrs
        required: false
        type: boolean
        example: false
      include_detection_summaries:
        description: Flag to include detection summaries in the response.
        in: query
        name: include_detection_summaries
        required: false
        type: boolean
        example: false
    HealthParamsV3_3:
      cache:
        default: true
        description: Flag to used cached data. If set to true, the response will include
          an 'updated_at' property with the time at which the health check was performed.
          Cached values will be no older than five minutes. Setting this to false
          will force a new health check.
        in: query
        name: cache
        required: false
        type: boolean
      vlans:
        default: true
        description: Flag to include or omit the list of VLANs observed from the returned
          data. Large environments with many vlans can result in slow performance
          from /health.
        in: query
        name: vlans
        required: false
        type: boolean
    AssignmentsListParamsV3:
      page_size:  
        description: Number of results to return per page.
        in: query
        name: page_size
        required: false
        type: integer
        minimum: 1
        maximum: 5000
      page:  
        description: A page number within the paginated result set.
        in: query
        name: page
        required: false
        type: integer
        minimum: 1
        example: 5
      accounts: 
        description: Filter on accounts ids. Accepts comma-separated list.
        in: query
        name: accounts
        required: false
        type: string
        example: 1,2
      hosts: 
        description: Filter on host ids. Accepts comma-separated list.
        in: query
        name: hosts
        required: false
        type: string
        example: 1,2
      assignees: 
        description: Filter on user assignee ids. Accepts comma-separated list.
        in: query
        name: assignees
        required: false
        type: string
        example: 1,2
      resolution: 
        description: Filter on given resolution ids. Accepts comma-separated lists.
        in: query
        name: resolution
        required: false
        type: string
        example: 1,2
      resolved: 
        description: Filter on resolved status.
        in: query
        name: resolved
        required: false
        type: boolean
        example: false
      created_after:  
        description: Filter on assignments created after the given timestamp.
        format: date-time
        in: query
        name: created_after
        required: false
        type: string
        example: '2025-01-08T18:07:35.127977+00:00'
    AssignmentsReadParamsV3:
      id:
        in: path
        name: id
        required: true
        description: The assignment id.
        type: integer
        example: 1
        minimum: 1
    RulesParamsV3:
      include_templates:
        description: Flag to include rules created with templates.
        in: query
        name: include_templates
        required: false
        type: boolean
      contains:
        description: A string to match rules if contained in the description, detection type, category, or last timestamp.
        in: query
        name: contains
        required: false
        type: string
      fields:
        description: Which fields to return in the results.
        in: query
        name: fields
        required: false
        type: string
        enum:
        - 'id'
        - 'url'
        - 'smart_category'
        - 'description'
        - 'type_vname'
        - 'category'
        - 'enabled'
        - 'created_timestamp'
        - 'last_timestamp'
        - 'host'
        - 'host_group'
        - 'ip_group'
        - 'all_hosts'
        - 'is_whitelist'
        - 'sensor_luid'
        - 'ip'
        - 'priority'
        - 'remote1_ip'
        - 'remote1_ip_groups'
        - 'remote1_proto'
        - 'remote1_port'
        - 'remote1_dns'
        - 'remote1_dns_groups'
        - 'remote2_ip'
        - 'remote2_ip_groups'
        - 'remote2_proto'
        - 'remote2_port'
        - 'remote2_dns'
        - 'remote2_dns_groups'
        - 'remote1_kerb_account'
        - 'remote1_kerb_service'
        - 'remote3_ip'
        - 'remote3_ip_groups'
        - 'identity'
        - 'active_detections'
        - 'total_detections'
        - 'flex1'
        - 'flex2'
        - 'flex3'
        - 'flex4'
        - 'flex5'
        - 'flex6'
        - 'flex7'
        - 'flex8'
        - 'flex9'
        - 'template'
    TaggingParamsV3_4:
      type:
        description: The type of taggable entity. Type required when
          table is set to entity.
        enum:
        - account
        - host
        - detection
        in: query
        name: type
        required: false
        type: string
        example: account
    TaggingParamsV3_3:
      table:
        description: The type of object to tag
        enum:
        - account
        - detection
        - host
        - entity
        in: path
        name: table
        required: true
        type: string
        example: account
      entity_type:  
        example: account
        description: The type of taggable entity. Type or entity_type required when
          table is set to entity.
        enum:
        - account
        - host
        - detection
        in: query
        name: entity_type
        type: string
        x-required-if:
          table: entity
      type: 
        description: The type of taggable entity. Type or entity_type required when
          table is set to entity.
        enum:
        - account
        - host
        - detection
        in: query
        name: type
        required: false
        type: string
        example: account
    TaggingParamsV3:
      entity_id:
        in: path
        name: entity_id
        required: true
        type: integer
        description: The entity id to patch or get tag.
        minimum: 1
        example: 1
      table:
        description: The type of entity to tag
        enum:
        - account
        - detection
        in: path
        name: table
        required: true
        type: string
        example: account
    NotesParamsV3_4:
      type:
        description: The type of note associated entity. The type param is required
          if tvui_types is set to entities.
        enum:
        - account
        - host
        in: query
        name: type
        type: string
        example: account
    NotesParamsV3_3:
      tvui_types:
        description: The type of note associated entity.
        enum:
        - accounts
        - detections
        - hosts
        - entities
        in: path
        name: tvui_types
        required: true
        type: string
      entity_type:
        description: The type of note associated entity. Type or entity_type is required
          if tvui_types is set to entities.
        enum:
        - account
        - host
        in: query
        name: entity_type
        type: string
      type:
        description: The type of note associated entity. Type or entity_type is required
          if tvui_types is set to entities.
        enum:
        - account
        - host
        in: query
        name: type
        type: string
    NotesParamsV3:
      tvui_types:
        description: The type of note associated entity.
        enum:
        - accounts
        - detections
        in: path
        name: tvui_types
        required: true
        type: string
      type_id:
        description: The type of entity id to tag.
        in: path
        name: type_id
        required: true
        type: integer
        minimum: 1
        example: 1
      note_id:
        description: The id associated with a note.
        in: path
        name: note_id
        required: true
        type: integer
        minimum: 1
        example: 1
    VectraMatchParamsV3_3:
      device_serial:
        description: Filter on the paired device serial number.
        in: query
        name: device_serial
        required: false
        type: string
  requestBodies: 
    BulkCreateNotesBodyV3_3:
      required: true
      content:
        application/json:
          schema:
            required:
              - note
              - objectIds
            type: object
            properties:
              note:
                type: string
                description: The note to create.
                example:  Example Note
              objectIds:
                type: array
                items:
                  type: integer
                example: 
                  - 1
                  - 2
    AssignmentOutcomePatchBodyV3:
      required: true
      content:
        application/json:
          schema:
            type: object
            properties:
              title:
                type: string
                description: The title of the outcome.
                example:  Benign True Positive
              category:
                type: string
                description: The outcome category.
                enum:
                - benign_true_positive
                - malicious_true_positive
                - false_positive
                - internal
                example: benign_true_positive
              builtin:
                type: boolean
                x-nullable: true
                description: Whether the outcome is a Vectra builtin outcome.
                example: false
              user_selectable:
                type: boolean
                x-nullable: true
                description: Whether the outcome can be selected by GUI users.
                example: false
    AssignmentOutcomePostBodyV3:
      required: true
      content:
        application/json:
          schema:
            required:
              - title
              - category
            type: object
            properties:
              title:
                type: string
                description: The title of the outcome.
                example:  Benign True Positive
              category:
                type: string
                description: The outcome category.
                enum:
                - benign_true_positive
                - malicious_true_positive
                - false_positive
                - internal
                example: benign_true_positive
              builtin:
                type: boolean
                x-nullable: true
                description: Whether the outcome is a Vectra builtin outcome.
                example: false
              user_selectable:
                type: boolean
                x-nullable: true
                description: Whether the outcome can be selected by GUI users.
                example: false 
    UsersPostBodyV3_4:
      required: true
      content:
        application/json:
          schema:
            properties:
              email:
                description: The email associated with the user.
                type: string
                example: "email@domain.com"
              role:
                description: The role associated with the user. Use the snake-case standardized name of the role. (e.g. "super_admins").
                type: string
                example: super_admins
              name:
                description: The first and last name of the user. Requires space separated first and last name.
                type: string
                example: John Doe
            required:
            - email
            - role
            - name
            type: object
    UsersPatchBodyV3_4:
      required: true
      content:
        application/json:
          schema:
            properties:
              role:
                description: The role associated with the user. Use the snake-case standardized name of the role.
                type: string
                example: super_admins
              name:
                description: The first and last name of the user. Requires space separated first and last name.
                type: string
                example: Jane Doe
            type: object
    AssignmentPostBodyV3_3:
      required: true
      content:
        application/json:
          schema:
            required:
              - assign_to_user_id
            type: object
            properties:
              assign_host_id:
                description: Host id associated with the assignment.
                  Required if assign_account_id is null.
                type: integer
                example: null
                x-nullable: true
              assign_account_id:
                type: integer
                example: 1
                x-nullable: true
                description: Account id associated with the assignment.
                  Required if assign_host_id is null.
              assign_to_user_id:
                description: User id assigned to the entity.
                type: integer
                example: 2
    AssignmentPostBodyV3:
      required: true
      content:
        application/json:
          schema:
            type: object
            required:
              - assign_to_user_id
              - assign_account_id
            properties:
              assign_account_id:
                description: Account id associated with the assignment.
                type: integer
                example: 1
              assign_to_user_id:
                description: User id assigned to the entity.
                type: integer
                example: 2
    AssignmentPutBodyV3_3:
      required: true
      content:
        application/json:
          schema:
            required:
              - assign_to_user_id
            type: object
            properties:
              assign_host_id:
                description: Host id associated with the assignment.
                type: integer
                example: null
                x-nullable: true
              assign_account_id:
                description: Account id associated with the assignment.
                type: integer
                example: 1
                x-nullable: true
              assign_to_user_id:
                description: User id assigned to the entity.
                type: integer
                example: 2
    AssignmentPutBodyV3:
      required: true
      content:
        application/json:
          schema:
            type: object
            required:
              - assign_to_user_id
            properties:
              assign_account_id:
                type: integer
                example: 1
                x-nullable: true
                description: Account id associated with the assignment.
              assign_to_user_id:
                description: User id assigned to the entity.
                type: integer
                example: 2
    AssignmentsResolveBodyV3:
      required: true
      content:
        application/json:
          schema:
            required:
              - outcome
            type: object
            properties:
              detection_ids:
                description: List of detection ids to mark as fixed or triage.
                items:
                  type: integer
                  example: 1
                type: array
              mark_as_fixed:
                type: boolean
                example: true 
                description: A flag to mark the selected detection ids as fixed.
              note:
                type: string
                example: Example note
                description: A note to add for the assignment.
              outcome:
                type: integer
                example: 1
                description: The id of the desired outcome for the assignment.
              triage_as:
                type: string
                example: Example triage rule 
                description: Create a singleton triage rule which applies only to the detection ids selected.
    BulkTaggingBodyV3:
      required: true
      content:
        application/json:
          schema:
            type: object
            required:
              - tag
              - objectIds
            properties:
              objectIds:
                description: The entity ids to create or delete the tag on.
                items:
                  type: integer
                  example: 1
                type: array
              tag:
                type: string
                example: Example tag
    GroupPatchBodyV3_4:
      required: true
      content:
        schema:
          properties:
            description:
              description: Group description.
              type: string
              example: New description
            importance:
              description: Group importance.
              type: string
              example: Low
            members:
              description: Group members. Use uid for Account Groups. Include this field to transition a Dynamic Group (regex) to a Static Group (members). If you would like to transition a static_member group to a dynamic (regex) group, please pass this parameter with the value set as "null" in conjuction with the regex param.
              x-nullable: true
              items:
                example: 1
                oneOf:
                - type: string
                - type: integer
              type: array/null
            name:
              description: Group name.
              type: string
              example: Example Host Group New Name
            regex:
              description: Regex expression. Include this field to transition to a Dynamic Group. Only valid for Host and Account Groups. This cannot be used with members or ad_group_dn. If you would like to transition a dynamic group to a static group, please pass this parameter with the value set as "null" in conjuction with the members param.
              type: string/null
              example: "(\\w\\d)*@vectra.ai"
              x-nullable: true
            ad_group_dn:
              description: This field is only used to transition an AD Group to a static group. To transition, please pass in this parameter with the value set as "null" in conjuction with the members param. 
              type: null
              x-nullable: true
            type:
              description: Group membership type.
              enum:
              - account
              - ip
              - host
              - domain
              type: string
              example: host
          type: object
    GroupPostBodyV3_4:
      required: true
      content:
        schema:
          properties:
            description:
              description: Group description.
              type: string
              example: Example description
            importance:
              description: Group importance.
              type: string
              example: High
            members:
              example: null
              description: Group members for a Static Group. Use uid for Account Groups. This cannot be used with regex or ad_group_dn.
              items:
                oneOf:
                - type: string
                  title: String input
                - type: integer
                  title: Integer input
              type: array
              x-nullable: true
            name:
              description: Group name.
              type: string
              example: Example host group
            regex:
              description: Regex expression to create a Dynamic Group. Only valid for Host and Account Groups. This cannot be used with member or ad_group_dn.
              type: string
              example: "(\\w\\d)*@vectra.ai"
              x-nullable: true
            ad_group_dn:
              description: use a AD DN to create a Active Directory Group. Only valid for Host and Account Groups. This cannot be used with member or regex.
              type: string
              example: "CN=SampleGroup,OU=Groups,DC=example,DC=com"
              x-nullable: true
            type:
              description: Group membership type.
              enum:
              - account
              - host
              - ip
              - domain
              type: string
              example: host
          required:
          - type
          - name
          - description
          - importance
          type: object
    GroupPatchBodyV3_2:
      required: true
      content:
        application/json:
          schema:
          properties:
            description:
              type: string
              example: Example description
            importance:
              type: string
              example: High
            members:
              items:
                type: string
                example: "email@domain.com"
              type: array
            name:
              type: string
              example: Example Account Group
            type:
              enum:
              - account
              type: string
          type: object
    GroupPostBodyV3_2:
      required: true
      content:
        application/json:
          schema:
          properties:
            description:
              type: string
              example: Example description
            importance:
              type: string
              example: High
            members:
              example: null
              description: Group members for a Static Group. Use uid for Account Groups. Dynamic Group membership cannot be edited.
              items:
                oneOf:
                - type: string
                  title: String input
                - type: integer
                  title: Integer input
              type: array
            name:
              type: string
              example: Example Account Group
            type:
              enum:
              - account
              type: string
          required:
          - type
          - name
          - importance
          - description
          type: object
    TaggingBodyV3:
      required: true
      content:
        application/json:
          schema:
            type: object
            required:
              - tags
            properties:
              tags:
                description: A list of tags to replace the existing entity tags.
                items:
                  type: string
                  example: Example tag
                type: array
    NotesBodyV3:
      required: true
      content:
        application/json:
          schema:
            type: object
            required:
              - note
            properties:
              note:
                type: string
                description: The new or updated entity note.
                example: Example note
    MatchAssignmentBodyV3_3:
      required: true
      content:
        application/json:
          schema:
            properties:
              device_serials:
                description: Device serials to assign with the rule set of the UUID.
                items:
                  type: string
                  example: L839261748511729ceace80jh2g46f12ff
                type: array
              uuid:
                description: UUID associated with the ruleset
                type: string
                example: "8cc9a23f-76e4-3035-8h5f-d4728d8g3h76"
            required:
              - uuid
              - device_serials
            type: object
x-tagGroups:
  - name: Authorization
    tags:
      - auth

  - name: Version 3.4
    tags:
      - v3.4/accounts
      - v3.4/detections
      - v3.4/assignments
      - v3.4/assignment_outcomes
      - v3.4/rules
      - v3.4/entities
      - v3.4/events
      - v3.4/groups
      - v3.4/health
      - v3.4/hosts
      - v3.4/lockdown
      - v3.4/tagging
      - v3.4/users
      - v3.4/match
      - v3.4/deprecated
      - v3.4/notes
      - v3.4/threatFeeds
      - v3.4/unique_hosts
      - v3.4/health/external_connectors
      - v3.4/health/edr
      - v3.4/health/network_brain
      - v3.4/notifications/receivers
      - v3.4/events/health
      - v3.4/data_source/connectors
      - v3.4/settings/active_directory/groups

  - name: Version 3.3
    tags:
      - v3.3/accounts
      - v3.3/detections
      - v3.3/assignments
      - v3.3/assignment_outcomes
      - v3.3/rules
      - v3.3/entities
      - v3.3/events
      - v3.3/groups
      - v3.3/health
      - v3.3/hosts
      - v3.3/lockdown
      - v3.3/tagging
      - v3.3/users
      - v3.3/match
      - v3.3/deprecated
      - v3.3/notes
      - v3.3/threatFeeds
      - v3.3/unique_hosts

  - name: Version 3.2
    tags:
      - v3.2/accounts
      - v3.2/detections
      - v3.2/assignments
      - v3.2/assignment_outcomes
      - v3.2/rules
      - v3.2/entities
      - v3.2/events
      - v3.2/groups
      - v3.2/tagging
      - v3.2/notes

  - name: Version 3.1
    tags:
      - v3.1/accounts
      - v3.1/detections
      - v3.1/assignments
      - v3.1/assignment_outcomes
      - v3.1/rules
      - v3.1/entities
      - v3.1/events
      - v3.1/tagging
      - v3.1/notes
  
  - name: Version 3
    tags:
      - v3/accounts
      - v3/detections
      - v3/assignments
      - v3/assignment_outcomes
      - v3/rules
      - v3/events
      - v3/tagging
      - v3/notes