Assets GraphQL API

On this page: ⫘

Query ⫘

Red Cloak TDR uses GraphQL queries, which can either be a read (Query) or a write (Mutation) operation. A GraphQL query is used to read or fetch values; mutations write or post values. Responses are provided in a JSON format.

Field ⫘

node Type: Node ⫘

Arguments ⫘

id Type: ID! ⫘

Field ⫘

tag Type: Tag! ⫘

Gen an asset tag by id

Arguments ⫘

id Type: ID! ⫘

Field ⫘

asset Type: Asset! ⫘

Get an asset by id

Arguments ⫘

id Type: ID! ⫘

Field ⫘

assetsByTag Type: [Asset!]! ⫘

Get a list of assets with tag

Arguments ⫘

tags Type: [String!]! ⫘

Field ⫘

allUniqueTags Type: [String!]! ⫘

Get a list of all unique tags

Field ⫘

assetEndpointInfo Type: EndpointInfo! ⫘

Get RedCloak endpoint info by id

Arguments ⫘

id Type: ID! ⫘

Field ⫘

assetEndpointInfoV2 Type: EndpointInfo! ⫘

Get RedCloak endpoint info by id with TDR module health

Arguments ⫘

id Type: ID! ⫘

Field ⫘

allAssets Type: AssetsResult ⫘

Get a list of assets

Arguments ⫘

offset Type: Int ⫘

limit Type: Int ⫘

order_by Type: AssetsOrderByInput ⫘

order_direction Type: AssetsOrderDirectionInput ⫘

filter_asset_state Type: AssetStateFilter ⫘

only_most_recent Type: Boolean ⫘

Field ⫘

allAssetsExport Type: AssetsResult ⫘

Get a list of assets for export to CSV

Arguments ⫘

offset Type: Int ⫘

limit Type: Int ⫘

Field ⫘

assetCount Type: AssetCounts! ⫘

Count of assets of a specific endpoint_type

Arguments ⫘

endpoint_type Type: AgentType ⫘

Field ⫘

assetCountGroupByEndpointType Type: [AssetCountsByEndpointType!]! ⫘

Important

assetCountGroupByEndpointType does not return data for Taegis Endpoint Agents. Use facetInfoV2 with the Endpoint Assets GraphQL API to return data for all endpoint types instead.

Count of assets grouped by endpoint_type

Field ⫘

allAssetsCount Type: AssetCounts! ⫘

Count of all assets

Field ⫘

assetsByIds Type: [Asset!]! ⫘

Bulk lookup by ids

Arguments ⫘

ids Type: [ID!] ⫘

Field ⫘

assetsByHostIds Type: [Asset!]! ⫘

Bulk lookup by hostIds

Arguments ⫘

hostIds Type: [String!] ⫘

Field ⫘

assetsByIpAddresses Type: [Asset!]! ⫘

Bulk lookup by ipAddress

Arguments ⫘

ipAddresses Type: [String!] ⫘

Field ⫘

allAssetHistories Type: [AssetHistory!]! ⫘

Get a list of asset histories for the tenant

Arguments ⫘

offset Type: Int ⫘

limit Type: Int ⫘

Field ⫘

assetRedCloakHistories Type: [AssetRedCloakHistory!]! ⫘

Get history of actions on an asset by id (includes RedCloack history)

Arguments ⫘

id Type: ID! ⫘

offset Type: Int ⫘

limit Type: Int ⫘

Field ⫘

searchAssets Type: AssetsResult ⫘

search assets. Soon to be deprecated

Arguments ⫘

offset Type: Int ⫘

limit Type: Int ⫘

hostname Type: String ⫘

host_id Type: String ⫘

ip_address Type: String ⫘

mac_address Type: String ⫘

os_version Type: String ⫘

os_family Type: String ⫘

os_distributor Type: String ⫘

sensor_version Type: String ⫘

username Type: String ⫘

endpoint_type Type: String ⫘

tag Type: String ⫘

host_id_partial_match Type: Boolean ⫘

only_most_recent Type: Boolean ⫘

order_by Type: AssetsOrderByInput ⫘

order_direction Type: AssetsOrderDirectionInput ⫘

or_search Type: Boolean ⫘

filter_asset_state Type: AssetStateFilter ⫘

Field ⫘

searchAssetsV2 Type: AssetsResult ⫘

search assets v2

Arguments ⫘

input Type: SearchAssetsInput! ⫘

paginationInput Type: SearchAssetsPaginationInput ⫘

Field ⫘

exportSearchAssets Type: AssetsExportOutput ⫘

export search assets results

Arguments ⫘

input Type: SearchAssetsInput! ⫘

paginationInput Type: SearchAssetsPaginationInput ⫘

legacy Type: Boolean ⫘

Field ⫘

retrieve a list of facets for a given endpoint type

Field ⫘

facetInfo Type: [FacetInfo]! ⫘

get facet info based on a currently selected facet

Arguments ⫘

orderBy Type: FacetInfoOrderByInput ⫘

where Type: AssetWhereInput ⫘

Field ⫘

assets Type: Assets! ⫘

retrieve assets

Arguments ⫘

first Type: Int ⫘

last Type: Int ⫘

after Type: String ⫘

before Type: String ⫘

where Type: AssetWhereInput ⫘

orderBy Type: AssetSearchOrderByInput ⫘

Field ⫘

assetsBySession Type: [Asset!]! ⫘

Return a list of assets for multiple tenants

Arguments ⫘

arguments Type: AssetsBySessionArguments! ⫘

Mutation ⫘

Mutations in GraphQL enable you to modify data. For the Red Cloak TDR Alerts GraphQL API, mutations allow you to create alerts and input information into alerts. For more information on GraphQL mutations see Mutation and Input Types.

Field ⫘

isolateAsset Type: Asset! ⫘

Isolate an asset by id

Arguments ⫘

id Type: ID! ⫘

reason Type: String! ⫘

Field ⫘

sendIsolate Type: Asset! ⫘

Arguments ⫘

id Type: ID! ⫘

reason Type: String! ⫘

Field ⫘

sendDeisolate Type: Asset! ⫘

Arguments ⫘

id Type: ID! ⫘

reason Type: String! ⫘

Field ⫘

integrateAsset Type: Asset! ⫘

Integrate an asset by id

Arguments ⫘

id Type: ID! ⫘

reason Type: String! ⫘

Field ⫘

deleteAssets Type: Boolean ⫘

Delete or un-delete asset

Arguments ⫘

ids Type: [ID!]! ⫘

undelete Type: Boolean ⫘

Field ⫘

createAssetTag Type: Tag! ⫘

Create a new tag for an asset

Arguments ⫘

hostId Type: String! ⫘

tag Type: String! ⫘

Field ⫘

updateAssetTag Type: Tag! ⫘

Updates a tag for an asset

Arguments ⫘

id Type: ID! ⫘

tag Type: String! ⫘

Field ⫘

deleteAssetTag Type: Tag ⫘

Deletes a tag for an asset

Arguments ⫘

id Type: ID! ⫘

Field ⫘

updateAsset Type: Asset! ⫘

Arguments ⫘

assetInput Type: AssetInput ⫘

Field ⫘

addInvestigationAssets Type: [Asset!]! ⫘

add investigation assets relation for the list of host_ids and return the asset ids

Arguments ⫘

hostIds Type: [String] ⫘

assetIds Type: [String] ⫘

investigationId Type: String! ⫘

Field ⫘

removeInvestigationAssets Type: Boolean! ⫘

remove investigation assets relation

Arguments ⫘

assetIds Type: [String!] ⫘

investigationId Type: String! ⫘

Objects ⫘

Asset ⫘

Describes an Asset in Red Cloak TDR.

Field ⫘

id Type: ID! ⫘

Field ⫘

hostId Type: String! ⫘

Field ⫘

rn Type: String! ⫘

Field ⫘

tenantId Type: String! ⫘

Field ⫘

sensorTenant Type: String! ⫘

Field ⫘

sensorId Type: String! ⫘

Field ⫘

ingestTime Type: Time! ⫘

Field ⫘

createdAt Type: Time! ⫘

Field ⫘

updatedAt Type: Time! ⫘

Field ⫘

deletedAt Type: Time ⫘

Field ⫘

biosSerial Type: String ⫘

Field ⫘

firstDiskSerial Type: String ⫘

Field ⫘

systemVolumeSerial Type: String ⫘

Field ⫘

sensorVersion Type: String ⫘

Field ⫘

endpointType Type: String ⫘

Field ⫘

endpointPlatform Type: String ⫘

Field ⫘

hostnames Type: [Hostname!]! ⫘

Field ⫘

ethernetAddresses Type: [EthernetAddress!]! ⫘

Field ⫘

ipAddresses Type: [IpAddress!]! ⫘

Field ⫘

users Type: [User!]! ⫘

Field ⫘

architecture Type: String ⫘

Field ⫘

osFamily Type: String ⫘

Field ⫘

osVersion Type: String ⫘

Field ⫘

osDistributor Type: String ⫘

Field ⫘

osRelease Type: String ⫘

Field ⫘

systemType Type: String ⫘

Field ⫘

osCodename Type: String ⫘

Field ⫘

kernelRelease Type: String ⫘

Field ⫘

kernelVersion Type: String ⫘

Field ⫘

tags Type: [Tag!]! ⫘

Field ⫘

connectionStatus Type: String ⫘

Field ⫘

model Type: String ⫘

Field ⫘

cloudProviderName Type: String ⫘

Field ⫘

cloudInstanceId Type: String ⫘

Field ⫘

endpointGroup Type: EndpointGroup ⫘

Field ⫘

status Type: String ⫘

AssetCounts ⫘

Count of assets

Field ⫘

count Type: Int! ⫘

AssetCountsByEndpointType ⫘

Field ⫘

endpointType Type: String! ⫘

Field ⫘

count Type: Int! ⫘

AssetHistory ⫘

Describes the history of an asset.

Field ⫘

id Type: ID! ⫘

Field ⫘

createdAt Type: Time! ⫘

Field ⫘

updatedAt Type: Time! ⫘

Field ⫘

assetId Type: ID! ⫘

Field ⫘

tenantId Type: String! ⫘

Field ⫘

hostId Type: String! ⫘

Field ⫘

action Type: String! ⫘

Field ⫘

who Type: String! ⫘

Field ⫘

reason Type: String! ⫘

AssetHistoryContact ⫘

Describes the contact of an asset history.

Field ⫘

email Type: String ⫘

Field ⫘

name Type: String ⫘

Field ⫘

sub Type: String ⫘

AssetHistoryEvent ⫘

Describes the event of an asset history.

Field ⫘

domainName Type: String ⫘

Field ⫘

hostName Type: String ⫘

AssetHistoryId ⫘

Contains the host id and instance id of an asset history.

Field ⫘

hostId Type: String ⫘

Field ⫘

instanceId Type: String ⫘

AssetRedCloakHistory ⫘

Describes the Red Cloak agent history of an asset.

Field ⫘

action Type: String ⫘

Field ⫘

allowedDomain Type: [String] ⫘

Field ⫘

assetId Type: String ⫘

Field ⫘

contact Type: AssetHistoryContact ⫘

Field ⫘

createdAt Type: String ⫘

Field ⫘

event Type: AssetHistoryEvent ⫘

Field ⫘

id Type: AssetHistoryId ⫘

Field ⫘

reason Type: String ⫘

Field ⫘

tenantId Type: String ⫘

Assets ⫘

Field ⫘

totalCount Type: Int! ⫘

Field ⫘

assets Type: [Asset]! ⫘

Field ⫘

pageInfo Type: PageInfo ⫘

AssetsExportOutput ⫘

Field ⫘

columnDef Type: [String!]! ⫘

Field ⫘

rows Type: [[String!]!]! ⫘

Field ⫘

totalCount Type: Int ⫘

AssetsResult ⫘

Describes the return type of the AllAssets and SearchAssets queries.

Field ⫘

totalResults Type: Int! ⫘

Field ⫘

offset Type: Int! ⫘

Field ⫘

limit Type: Int! ⫘

Field ⫘

assets Type: [Asset!]! ⫘

EndpointGroup ⫘

Describes the endpoint group information of a asset.

Field ⫘

id Type: ID! ⫘

EndpointInfo ⫘

Describes the endpoint information of a Red Cloak agent asset.

Field ⫘

actualIsolationStatus Type: Boolean ⫘

Field ⫘

allowedDomain Type: [String] ⫘

Field ⫘

color Type: String ⫘

Field ⫘

desiredIsolationStatus Type: Boolean ⫘

Field ⫘

firstConnectTime Type: String ⫘

Field ⫘

hostId Type: String ⫘

Field ⫘

hostName Type: String ⫘

Field ⫘

ignitionDetails Type: IgnitionDetails ⫘

Field ⫘

lastConnectAddress Type: String ⫘

Field ⫘

lastConnectServer Type: String ⫘

Field ⫘

lastConnectTime Type: String ⫘

Field ⫘

lastCrashCheck Type: String ⫘

Field ⫘

lastModuleStatusTime Type: String ⫘

Field ⫘

lastPredicateAuthtap Type: String ⫘

Field ⫘

lastPredicateCyclorama Type: String ⫘

Field ⫘

lastPredicateEntwine Type: String ⫘

Field ⫘

lastPredicateGroundling Type: String ⫘

Field ⫘

lastPredicateHostel Type: String ⫘

Field ⫘

lastPredicateLacuna Type: String ⫘

Field ⫘

lastPredicateMukluk Type: String ⫘

Field ⫘

lastPredicatePeriodicscanControl Type: String ⫘

Field ⫘

lastPredicatePeriodicscanResult Type: String ⫘

Field ⫘

lastPredicateProcwall Type: String ⫘

Field ⫘

lastPredicateSystemInformation Type: String ⫘

Field ⫘

moduleHealth Type: [ModuleHealth] ⫘

Field ⫘

moduleStatus Type: [ModuleStatus] ⫘

Field ⫘

notableEventCount Type: Int ⫘

Field ⫘

sensorVersion Type: Int ⫘

Field ⫘

systemInformation Type: SystemInformation ⫘

Field ⫘

moduleHealthV2 Type: [ModuleHealthV2] ⫘

EthernetAddress ⫘

Describes the ethernet address of an asset.

Field ⫘

id Type: ID! ⫘

Field ⫘

createdAt Type: Time! ⫘

Field ⫘

updatedAt Type: Time! ⫘

Field ⫘

hostId Type: String! ⫘

Field ⫘

mac Type: String! ⫘

Field ⫘

label Type: String! ⫘

Field ⫘

searchOnly Type: Boolean! ⫘

FacetFieldInfo ⫘

Field ⫘

field Type: String! ⫘

Field ⫘

count Type: Int ⫘

FacetInfo ⫘

Field ⫘

fields Type: [FacetFieldInfo]! ⫘

Hostname ⫘

Describes the hostname of an asset.

Field ⫘

id Type: ID! ⫘

Field ⫘

createdAt Type: Time! ⫘

Field ⫘

updatedAt Type: Time! ⫘

Field ⫘

hostId Type: String! ⫘

Field ⫘

hostname Type: String! ⫘

IgnitionDetails ⫘

Describes the ignition details of a Red Cloak agent asset.

Field ⫘

isEndpointConfigExist Type: Boolean ⫘

Field ⫘

requestStatus Type: String ⫘

IpAddress ⫘

Describes the IP Address of an asset.

Field ⫘

id Type: ID! ⫘

Field ⫘

createdAt Type: Time! ⫘

Field ⫘

updatedAt Type: Time! ⫘

Field ⫘

ip Type: String! ⫘

Field ⫘

hostId Type: String! ⫘

ModuleHealth ⫘

Describes the ModuleHealth of a Red Cloak agent asset.

Field ⫘

enabled Type: String ⫘

Field ⫘

lastPredicateTime Type: String ⫘

Field ⫘

lastRunningTime Type: String ⫘

Field ⫘

moduleColor Type: String ⫘

Field ⫘

moduleDisplayName Type: String ⫘

ModuleHealthV2 ⫘

Describes the module event processing time of a Red Cloak agent asset on TDR.

Field ⫘

lastEventProcessingTime Type: Time ⫘

Field ⫘

moduleName Type: String ⫘

ModuleStatus ⫘

Describes the module status of a Red Cloak agent asset.

Field ⫘

enabled Type: Boolean ⫘

Field ⫘

moduleName Type: String ⫘

Field ⫘

moduleState Type: String ⫘

PageInfo ⫘

Field ⫘

endCursor Type: String ⫘

Field ⫘

startCursor Type: String ⫘

Field ⫘

hasNextPage Type: Boolean! ⫘

Field ⫘

hasPreviousPage Type: Boolean! ⫘

SystemInformation ⫘

Describes the system information of a Red Cloak agent asset.

Field ⫘

architecture Type: String ⫘

Field ⫘

biosSerial Type: String ⫘

Field ⫘

ethernetAddress Type: [String] ⫘

Field ⫘

firstDiskSerial Type: String ⫘

Field ⫘

hostName Type: String ⫘

Field ⫘

ipAddress Type: [String] ⫘

Field ⫘

isServerR2For2003And2008 Type: Boolean ⫘

Field ⫘

productType Type: String ⫘

Field ⫘

redcloakVersion Type: Int ⫘

Field ⫘

servicePack Type: String ⫘

Field ⫘

systemVolumeSerial Type: String ⫘

Field ⫘

windowsVersion Type: String ⫘

Tag ⫘

Describes the tag data associated with an asset

Field ⫘

id Type: ID! ⫘

Field ⫘

hostId Type: String! ⫘

Field ⫘

tenantId Type: String! ⫘

Field ⫘

createdAt Type: Time! ⫘

Field ⫘

updatedAt Type: Time! ⫘

Field ⫘

tag Type: String! ⫘

UpdateTag ⫘

Describes the tag data associated with an asset

Field ⫘

id Type: ID! ⫘

Field ⫘

tenantId Type: String! ⫘

Field ⫘

tag Type: String! ⫘

User ⫘

Describes the user of an asset.

Field ⫘

id Type: ID! ⫘

Field ⫘

createdAt Type: Time! ⫘

Field ⫘

updatedAt Type: Time! ⫘

Field ⫘

hostId Type: String! ⫘

Field ⫘

username Type: String! ⫘

Inputs ⫘

AssetInput ⫘

Describes the input of Asset data for creating an Asset Tag

Field ⫘

id Type: ID! ⫘

Field ⫘

tags Type: [String!]! ⫘

AssetWhereInput ⫘

Field ⫘

and Type: [AssetWhereInput] ⫘

Field ⫘

or Type: [AssetWhereInput] ⫘

Field ⫘

not Type: AssetWhereInput ⫘

Field ⫘

id Type: ID ⫘

Field ⫘

hostname Type: String ⫘

Field ⫘

hostname_contains Type: String ⫘

Field ⫘

hostId Type: String ⫘

Field ⫘

hostId_contains Type: String ⫘

Field ⫘

ipAddress Type: String ⫘

Field ⫘

ipAddress_contains Type: String ⫘

Field ⫘

macAddress Type: String ⫘

Field ⫘

macAddress_contains Type: String ⫘

Field ⫘

osVersion Type: String ⫘

Field ⫘

osFamily Type: String ⫘

Field ⫘

osDistributor Type: String ⫘

Field ⫘

sensorVersion Type: String ⫘

Field ⫘

systemType Type: String ⫘

Field ⫘

endpointType Type: String ⫘

Field ⫘

filterAssetState Type: AssetStateFilter ⫘

Field ⫘

username Type: String ⫘

Field ⫘

username_contains Type: String ⫘

Field ⫘

tag Type: String ⫘

Field ⫘

tag_contains Type: String ⫘

AssetsBySessionArguments ⫘

Field ⫘

key Type: String! ⫘

Field ⫘

offset Type: Int ⫘

Field ⫘

limit Type: Int ⫘

SearchAssetsInput ⫘

Field ⫘

hostname Type: String ⫘

Field ⫘

host_id Type: String ⫘

Field ⫘

ip_address Type: String ⫘

Field ⫘

mac_address Type: String ⫘

Field ⫘

os_version Type: String ⫘

Field ⫘

os_family Type: String ⫘

Field ⫘

os_distributor Type: String ⫘

Field ⫘

sensor_version Type: String ⫘

Field ⫘

username Type: String ⫘

Field ⫘

endpoint_type Type: String ⫘

Field ⫘

tag Type: String ⫘

Field ⫘

host_id_partial_match Type: Boolean ⫘

Field ⫘

only_most_recent Type: Boolean ⫘

Field ⫘

or_search Type: Boolean ⫘

Field ⫘

filter_asset_state Type: AssetStateFilter ⫘

Field ⫘

investigation_id Type: String ⫘

SearchAssetsPaginationInput ⫘

Field ⫘

offset Type: Int ⫘

Field ⫘

limit Type: Int ⫘

Field ⫘

order_by Type: AssetsOrderByInput ⫘

Field ⫘

order_direction Type: AssetsOrderDirectionInput ⫘

Enums ⫘

AgentType ⫘

Type of Red Cloak endpoint agent.

ENDPOINT_REDCLOAK

ENDPOINT_CARBON_BLACK

ENDPOINT_CROWD_STRIKE

ENDPOINT_MICROSOFT_ATP

ENDPOINT_CARBON_BLACK_PSC

AssetSearchOrderByInput ⫘

os_version_asc

os_version_desc

created_at_asc

created_at_desc

updated_at_asc

updated_at_desc

os_family_asc

os_family_desc

os_distributor_asc

os_distributor_desc

sensor_version_asc

sensor_version_desc

AssetStateFilter ⫘

All

Deleted

Active

Unhealthy

AssetsOrderByInput ⫘

Describes the enums available for the ordering of the AllAssets and SearchAssets queries.

hostname

ip_address

mac_address

tag

username

os_version

endpoint_type

created_at

updated_at

deleted_at

os_family

os_distributor

sensor_version

AssetsOrderDirectionInput ⫘

Describes the order direction available for the order field of the AllAssets and SearchAssets queries.

asc

desc

EndpointType ⫘

ENDPOINT_REDCLOAK

ENDPOINT_THIRD_PARTY

FacetInfoOrderByInput ⫘

count_desc

count_asc

Scalars ⫘

Boolean ⫘

The Boolean scalar type represents true or false.

ID ⫘

The ID scalar type represents a unique identifier, often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as "4") or integer (such as 4) input value will be accepted as an ID.

Int ⫘

The Int scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1.

String ⫘

The String scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.