🌙
 

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

On this page:

Query

Red Cloak TDR uses GraphQL queries, which can either be a read (Query) or a write (Mutation) operation. A GraphQL query is used to read or fetch values; mutations write or post values. Responses are provided in a JSON format.

Field

node Type: Node

Arguments
id Type: ID!
Field

tag Type: Tag!

Gen an asset tag by id

Arguments
id Type: ID!
Field

asset Type: Asset!

Get an asset by id

Arguments
id Type: ID!
Field

assetsByTag Type: [Asset!]!

Get a list of assets with tag

Arguments
tags Type: [String!]!
Field

allUniqueTags Type: [String!]!

Get a list of all unique tags

Field

assetEndpointInfo Type: EndpointInfo!

Get RedCloak endpoint info by id

Arguments
id Type: ID!
Field

assetEndpointInfoV2 Type: EndpointInfo!

Get RedCloak endpoint info by id with TDR module health

Arguments
id Type: ID!
Field

allAssets Type: AssetsResult

Get a list of assets

Arguments
offset Type: Int
limit Type: Int
order_by Type: AssetsOrderByInput
order_direction Type: AssetsOrderDirectionInput
filter_asset_state Type: AssetStateFilter
only_most_recent Type: Boolean
Field

allAssetsExport Type: AssetsResult

Get a list of assets for export to CSV

Arguments
offset Type: Int
limit Type: Int
Field

assetCount Type: AssetCounts!

Count of assets of a specific endpoint_type

Arguments
endpoint_type Type: AgentType
Field

assetCountGroupByEndpointType Type: [AssetCountsByEndpointType!]!

Important

assetCountGroupByEndpointType does not return data for Taegis™ Endpoint Agents. Use facetInfoV2 with the Endpoint Assets GraphQL API to return data for all endpoint types instead.

Count of assets grouped by endpoint_type

Field

allAssetsCount Type: AssetCounts!

Count of all assets

Field

assetsByIds Type: [Asset!]!

Bulk lookup by ids

Arguments
ids Type: [ID!]
Field

assetsByHostIds Type: [Asset!]!

Bulk lookup by hostIds

Arguments
hostIds Type: [String!]
Field

assetsByIpAddresses Type: [Asset!]!

Bulk lookup by ipAddress

Arguments
ipAddresses Type: [String!]
Field

allAssetHistories Type: [AssetHistory!]!

Get a list of asset histories for the tenant

Arguments
offset Type: Int
limit Type: Int
Field

assetRedCloakHistories Type: [AssetRedCloakHistory!]!

Get history of actions on an asset by id (includes RedCloack history)

Arguments
id Type: ID!
offset Type: Int
limit Type: Int
Field

searchAssets Type: AssetsResult

search assets. Soon to be deprecated

Arguments
offset Type: Int
limit Type: Int
hostname Type: String
host_id Type: String
ip_address Type: String
mac_address Type: String
os_version Type: String
os_family Type: String
os_distributor Type: String
sensor_version Type: String
username Type: String
endpoint_type Type: String
tag Type: String
host_id_partial_match Type: Boolean
only_most_recent Type: Boolean
order_by Type: AssetsOrderByInput
order_direction Type: AssetsOrderDirectionInput
or_search Type: Boolean
filter_asset_state Type: AssetStateFilter
Field

searchAssetsV2 Type: AssetsResult

search assets v2

Arguments
input Type: SearchAssetsInput!
paginationInput Type: SearchAssetsPaginationInput
Field

exportSearchAssets Type: AssetsExportOutput

export search assets results

Arguments
input Type: SearchAssetsInput!
paginationInput Type: SearchAssetsPaginationInput
legacy Type: Boolean
Field

facets Type: [Facet]!

retrieve a list of facets for a given endpoint type

Field

facetInfo Type: [FacetInfo]!

get facet info based on a currently selected facet

Arguments
facets Type: [String!]!
orderBy Type: FacetInfoOrderByInput
where Type: AssetWhereInput
Field

assets Type: Assets!

retrieve assets

Arguments
first Type: Int
last Type: Int
after Type: String
before Type: String
where Type: AssetWhereInput
orderBy Type: AssetSearchOrderByInput
Field

assetsBySession Type: [Asset!]!

Return a list of assets for multiple tenants

Arguments
arguments Type: AssetsBySessionArguments!

Mutation

Mutations in GraphQL enable you to modify data. For the Red Cloak TDR Alerts GraphQL API, mutations allow you to create alerts and input information into alerts. For more information on GraphQL mutations see Mutation and Input Types.

Field

isolateAsset Type: Asset!

Isolate an asset by id

Arguments
id Type: ID!
reason Type: String!
Field

integrateAsset Type: Asset!

Integate an asset by id

Arguments
id Type: ID!
reason Type: String!
Field

deleteAssets Type: Boolean

Delete or un-delete asset

Arguments
ids Type: [ID!]!
undelete Type: Boolean
Field

createAssetTag Type: Tag!

Create a new tag for an asseti

Arguments
hostId Type: String!
tag Type: String!
Field

updateAssetTag Type: Tag!

Updates a tag for an asset

Arguments
id Type: ID!
tag Type: String!
Field

deleteAssetTag Type: Tag

Deletes a tag for an asset

Arguments
id Type: ID!
Field

updateAsset Type: Asset!

Arguments
assetInput Type: AssetInput
Field

addInvestigationAssets Type: [Asset!]!

add investigation assets relation for the list of host_ids and return the asset ids

Arguments
hostIds Type: [String]
assetIds Type: [String]
investigationId Type: String!
Field

removeInvestigationAssets Type: Boolean!

remove investigation assets relation

Arguments
assetIds Type: [String!]
investigationId Type: String!

Objects

Asset

Describes an Asset in Red Cloak TDR.

Field

id Type: ID!

Field

hostId Type: String!

Field

rn Type: String!

Field

tenantId Type: String!

Field

sensorTenant Type: String!

Field

sensorId Type: String!

Field

ingestTime Type: Time!

Field

createdAt Type: Time!

Field

updatedAt Type: Time!

Field

deletedAt Type: Time

Field

biosSerial Type: String

Field

firstDiskSerial Type: String

Field

systemVolumeSerial Type: String

Field

sensorVersion Type: String

Field

endpointType Type: String

Field

endpointPlatform Type: String

Field

hostnames Type: [Hostname!]!

Field

ethernetAddresses Type: [EthernetAddress!]!

Field

ipAddresses Type: [IpAddress!]!

Field

users Type: [User!]!

Field

architecture Type: String

Field

osFamily Type: String

Field

osVersion Type: String

Field

osDistributor Type: String

Field

osRelease Type: String

Field

systemType Type: String

Field

osCodename Type: String

Field

kernelRelease Type: String

Field

kernelVersion Type: String

Field

tags Type: [Tag!]!

Field

connectionStatus Type: String

Field

model Type: String

Field

cloudProviderName Type: String

Field

cloudInstanceId Type: String

Field

endpointGroup Type: EndpointGroup

Field

status Type: String

AssetCounts

Count of assets

Field

count Type: Int!

AssetCountsByEndpointType

Field

endpointType Type: String!

Field

count Type: Int!

AssetHistory

Describes the history of an asset.

Field

id Type: ID!

Field

createdAt Type: Time!

Field

updatedAt Type: Time!

Field

assetId Type: ID!

Field

tenantId Type: String!

Field

hostId Type: String!

Field

action Type: String!

Field

who Type: String!

Field

reason Type: String!

AssetHistoryContact

Describes the contact of an asset history.

Field

email Type: String

Field

name Type: String

Field

sub Type: String

AssetHistoryEvent

Describes the event of an asset history.

Field

domainName Type: String

Field

hostName Type: String

AssetHistoryId

Contains the host id and instance id of an asset history.

Field

hostId Type: String

Field

instanceId Type: String

AssetRedCloakHistory

Describes the Red Cloak agent history of an asset.

Field

action Type: String

Field

allowedDomain Type: [String]

Field

assetId Type: String

Field

contact Type: AssetHistoryContact

Field

createdAt Type: String

Field

event Type: AssetHistoryEvent

Field

id Type: AssetHistoryId

Field

reason Type: String

Field

tenantId Type: String

Assets

Field

totalCount Type: Int!

Field

assets Type: [Asset]!

Field

pageInfo Type: PageInfo

AssetsExportOutput

Field

columnDef Type: [String!]!

Field

rows Type: [[String!]!]!

Field

totalCount Type: Int

AssetsResult

Describes the return type of the AllAssets and SearchAssets queries.

Field

totalResults Type: Int!

Field

offset Type: Int!

Field

limit Type: Int!

Field

assets Type: [Asset!]!

EndpointGroup

Describes the endpoint group information of a asset.

Field

id Type: ID!

EndpointInfo

Describes the endpoint information of a Red Cloak agent asset.

Field

actualIsolationStatus Type: Boolean

Field

allowedDomain Type: [String]

Field

color Type: String

Field

desiredIsolationStatus Type: Boolean

Field

firstConnectTime Type: String

Field

hostId Type: String

Field

hostName Type: String

Field

ignitionDetails Type: IgnitionDetails

Field

lastConnectAddress Type: String

Field

lastConnectServer Type: String

Field

lastConnectTime Type: String

Field

lastCrashCheck Type: String

Field

lastModuleStatusTime Type: String

Field

lastPredicateAuthtap Type: String

Field

lastPredicateCyclorama Type: String

Field

lastPredicateEntwine Type: String

Field

lastPredicateGroundling Type: String

Field

lastPredicateHostel Type: String

Field

lastPredicateLacuna Type: String

Field

lastPredicateMukluk Type: String

Field

lastPredicatePeriodicscanControl Type: String

Field

lastPredicatePeriodicscanResult Type: String

Field

lastPredicateProcwall Type: String

Field

lastPredicateSystemInformation Type: String

Field

moduleHealth Type: [ModuleHealth]

Field

moduleStatus Type: [ModuleStatus]

Field

notableEventCount Type: Int

Field

sensorVersion Type: Int

Field

systemInformation Type: SystemInformation

Field

moduleHealthV2 Type: [ModuleHealthV2]

EthernetAddress

Describes the ethernet address of an asset.

Field

id Type: ID!

Field

createdAt Type: Time!

Field

updatedAt Type: Time!

Field

hostId Type: String!

Field

mac Type: String!

Facet

Field

label Type: String!

Field

facet Type: String!

Field

searchOnly Type: Boolean!

FacetFieldInfo

Field

field Type: String!

Field

count Type: Int

FacetInfo

Field

facet Type: String!

Field

fields Type: [FacetFieldInfo]!

Hostname

Describes the hostname of an asset.

Field

id Type: ID!

Field

createdAt Type: Time!

Field

updatedAt Type: Time!

Field

hostId Type: String!

Field

hostname Type: String!

IgnitionDetails

Describes the ignition details of a Red Cloak agent asset.

Field

isEndpointConfigExist Type: Boolean

Field

requestStatus Type: String

IpAddress

Describes the IP Address of an asset.

Field

id Type: ID!

Field

createdAt Type: Time!

Field

updatedAt Type: Time!

Field

ip Type: String!

Field

hostId Type: String!

ModuleHealth

Describes the ModuleHealth of a Red Cloak agent asset.

Field

enabled Type: String

Field

lastPredicateTime Type: String

Field

lastRunningTime Type: String

Field

moduleColor Type: String

Field

moduleDisplayName Type: String

ModuleHealthV2

Describes the module event processing time of a Red Cloak agent asset on TDR.

Field

lastEventProcessingTime Type: Time

Field

moduleName Type: String

ModuleStatus

Describes the module status of a Red Cloak agent asset.

Field

enabled Type: Boolean

Field

moduleName Type: String

Field

moduleState Type: String

PageInfo

Field

endCursor Type: String

Field

startCursor Type: String

Field

hasNextPage Type: Boolean!

Field

hasPreviousPage Type: Boolean!

SystemInformation

Describes the system information of a Red Cloak agent asset.

Field

architecture Type: String

Field

biosSerial Type: String

Field

ethernetAddress Type: [String]

Field

firstDiskSerial Type: String

Field

hostName Type: String

Field

ipAddress Type: [String]

Field

isServerR2For2003And2008 Type: Boolean

Field

productType Type: String

Field

redcloakVersion Type: Int

Field

servicePack Type: String

Field

systemVolumeSerial Type: String

Field

windowsVersion Type: String

Tag

Describes the tag data associated with an asset

Field

id Type: ID!

Field

hostId Type: String!

Field

tenantId Type: String!

Field

createdAt Type: Time!

Field

updatedAt Type: Time!

Field

tag Type: String!

UpdateTag

Describes the tag data associated with an asset

Field

id Type: ID!

Field

tenantId Type: String!

Field

tag Type: String!

User

Describes the user of an asset.

Field

id Type: ID!

Field

createdAt Type: Time!

Field

updatedAt Type: Time!

Field

hostId Type: String!

Field

username Type: String!

Inputs

AssetInput

Describes the input of Asset data for creating an Asset Tag

Field

id Type: ID!

Field

tags Type: [String!]!

AssetWhereInput

Field

and Type: [AssetWhereInput]

Field

or Type: [AssetWhereInput]

Field

not Type: AssetWhereInput

Field

id Type: ID

Field

hostname Type: String

Field

hostname_contains Type: String

Field

hostId Type: String

Field

hostId_contains Type: String

Field

ipAddress Type: String

Field

ipAddress_contains Type: String

Field

macAddress Type: String

Field

macAddress_contains Type: String

Field

osVersion Type: String

Field

osFamily Type: String

Field

osDistributor Type: String

Field

sensorVersion Type: String

Field

systemType Type: String

Field

endpointType Type: String

Field

filterAssetState Type: AssetStateFilter

Field

username Type: String

Field

username_contains Type: String

Field

tag Type: String

Field

tag_contains Type: String

AssetsBySessionArguments

Field

key Type: String!

Field

offset Type: Int

Field

limit Type: Int

SearchAssetsInput

Field

hostname Type: String

Field

host_id Type: String

Field

ip_address Type: String

Field

mac_address Type: String

Field

os_version Type: String

Field

os_family Type: String

Field

os_distributor Type: String

Field

sensor_version Type: String

Field

username Type: String

Field

endpoint_type Type: String

Field

tag Type: String

Field

host_id_partial_match Type: Boolean

Field

only_most_recent Type: Boolean

Field

or_search Type: Boolean

Field

filter_asset_state Type: AssetStateFilter

Field

investigation_id Type: String

SearchAssetsPaginationInput

Field

offset Type: Int

Field

limit Type: Int

Field

order_by Type: AssetsOrderByInput

Field

order_direction Type: AssetsOrderDirectionInput

Enums

AgentType

Type of Red Cloak endpoint agent.

ENDPOINT_REDCLOAK

ENDPOINT_CARBON_BLACK

ENDPOINT_CROWD_STRIKE

ENDPOINT_MICROSOFT_ATP

ENDPOINT_CARBON_BLACK_PSC

AssetSearchOrderByInput

os_version_asc

os_version_desc

created_at_asc

created_at_desc

updated_at_asc

updated_at_desc

os_family_asc

os_family_desc

os_distributor_asc

os_distributor_desc

sensor_version_asc

sensor_version_desc

AssetStateFilter

All

Deleted

Active

Unhealthy

AssetsOrderByInput

Describes the enums available for the ordering of the AllAssets and SearchAssets queries.

hostname

ip_address

mac_address

tag

username

os_version

endpoint_type

created_at

updated_at

deleted_at

os_family

os_distributor

sensor_version

AssetsOrderDirectionInput

Describes the order direction available for the order field of the AllAssets and SearchAssets queries.

asc

desc

EndpointType

ENDPOINT_REDCLOAK

ENDPOINT_THIRD_PARTY

FacetInfoOrderByInput

count_desc

count_asc

Scalars

Boolean

The Boolean scalar type represents true or false.

ID

The ID scalar type represents a unique identifier, often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as "4") or integer (such as 4) input value will be accepted as an ID.

Int

The Int scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1.

String

The String scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.

Time

Default time implementation for this library.

Interfaces

Node

Field

id Type: ID!