🌙
 

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

On this page:

Query

Query Prometheus Endpoint

Field

node Type: Node

Arguments
id Type: ID!
Field

getCluster Type: Cluster

Get cluster by ID

Arguments
clusterID Type: ID!
Field

getAllClusters Type: [Cluster!]

Get all clusters provisioned on the tenant

Arguments
role Type: String!
Field

getClusterConfig Type: KubernetesConfig

Get a cluster's config

Arguments
clusterID Type: ID!
Field

getClusterImageV2 Type: Image

Get a cluster's image download link.

Arguments
input Type: ClusterImageInput!
Field

getClusterImage ⚠️ Type: Image

Deprecated, use getClusterImageV2 instead for consolidated inputs.

⚠️ DEPRECATED

Use `getClusterImageV2` instead for consolidated inputs.
Arguments
clusterID Type: ID!
imageType Type: ImageType!
launchConsole Type: Boolean
awsDetails Type: AWSDetails
gcpDetails Type: GCPDetails
Field

getCloudZones Type: [CloudRegion!]

Get a cloud service region and zones

Arguments
imageType Type: ImageType!
Field

getClusterCredentials Type: Credentials

Get a cluster's credentials

Arguments
clusterID Type: ID!
Field

getHosts Type: Hosts

Get all of the host->address mappings associated with a given cluster

Arguments
clusterID Type: ID!
Field

getClusterActivationDetails Type: Activation

Arguments
clusterID Type: ID!
Field

getSystemByRole Type: System

Arguments
role Type: String!
Field

getOSConfig Type: OSConfig

Arguments
clusterID Type: ID!
Field

getClusterStatuses Type: [Status!]

Get a cluster's statuses and helm resources deployed

Arguments
clusterID Type: ID!
Field

getClusterDeploymentStatus Type: ChartStatus

Get the status of a cluster deployment

Arguments
clusterID Type: ID!
deploymentID Type: ID!
Field

getChart Type: Chart

Get a single Helm chart by name

Arguments
chartName Type: String!
Field

getAllCharts Type: ChartList

Get all of the Helm charts available for deployment to any cluster

Field

getBillOfMaterials Type: BillOfMaterials

Field

getClusterDeployment Type: Deployment

Get a single deployment under a collector

Arguments
clusterID Type: ID!
deploymentID Type: ID!
Field

getAllClusterDeployments Type: [Deployment!]

Get all of the deployments under a collector

Arguments
clusterID Type: ID!
Field

getDeploymentEndpoint Type: Endpoint

Get an endpoint configured for a given deployment

Arguments
clusterID Type: ID!
deploymentID Type: ID!
endpointID Type: ID!
Field

getAllDeploymentEndpoints Type: [Endpoint!]

Get all of the endpoints configured for a given deployment

Arguments
clusterID Type: ID!
deploymentID Type: ID!
Field

getDeploymentEndpointCredentialsValidityPeriod Type: ValidityPeriod

Get EndpointCredential validity period

Arguments
clusterID Type: ID!
deploymentID Type: ID!
endpointID Type: ID!
Field

getAWSRegions Type: [String!]

Fetch list of AWS regions where we have images available

Field

getRoleDeployments Type: [Deployment!]

Get deployments to be installed on every cluster of a given role.

Arguments
role Type: String!
Field

getRoleDeployment Type: Deployment

Get a role based deployment by ID.

Arguments
deploymentID Type: ID!
Field

getAllCollectorsOverview Type: [CollectorOverview!]

Get all collector overview data for the given role and time range

Arguments
role Type: String!
timeRange Type: TimeRange!
Field

getCollectorMetrics Type: CollectorMetrics

Get collector data flow metrics over a given time range

Arguments
timeRange Type: TimeRange!
Field

getAggregateRateByCollector Type: AggregateRateByCollector

Get aggregated data flow rate metrics for a given collector over a given time range

Arguments
clusterID Type: ID!
timeRange Type: TimeRange!
Field

getFlowRate Type: FlowRate

Get flow rate metrics for a given collector over a given time range

Arguments
clusterID Type: ID!
timeRange Type: TimeRange!
Field

getLogLastSeenMetrics Type: LogLastSeenMetrics

Get last seen metrics for all available log sources for a given cluster. If no clusterId is specified, this will return all log sources metrics for all existing clusters

Arguments
clusterID Type: ID
Field

getDataSourceMetrics ⚠️ Type: DataSourceMetrics

Deprecated, use getDataSourceLastSeenAsset with the Datasource GraphQL API instead.

⚠️ DEPRECATED

Get metrics for all available data sources for a given cluster

Arguments
in Type: GetDataSourceMetricsArguments!

Mutation

Field

createCluster Type: Cluster

Create a new cluster of a given role

Arguments
clusterInput Type: ClusterInput!
Field

updateCluster Type: Cluster

Update a cluster

Arguments
clusterID Type: ID!
clusterInput Type: ClusterInput!
Field

deleteCluster Type: Deleted

Delete a cluster

Arguments
clusterID Type: ID!
Field

createOSConfig Type: OSConfig

Arguments
input Type: OSConfigInput!
Field

updateOSConfig Type: OSConfig

Arguments
input Type: OSConfigInput!
Field

deleteOSConfig Type: String!

Arguments
clusterID Type: ID!
Field

addHost Type: Hosts

Add a address:hostname mapping to a given cluster

Arguments
clusterID Type: ID!
hostInput Type: HostsInput!
Field

deleteHost Type: Deleted

Remove an address:hostname mapping from a given cluster by providing the IP address and associated host name

Arguments
clusterID Type: ID!
address Type: String!
Field

createClusterStatus Type: Status

Create the initial deployment status of a given cluster

Arguments
clusterID Type: ID!
statusInput Type: StatusInput!
Field

updateClusterStatus Type: Status

Update the deployment status of a given cluster

Arguments
clusterID Type: ID!
statusInput Type: StatusInput!
Field

deleteClusterStatus Type: Deleted

Delete the deployment status of a given cluster

Arguments
clusterID Type: ID!
deploymentID Type: ID!
Field

createClusterDeployment Type: Deployment

Create a deployment local to a given cluster

Arguments
clusterID Type: ID!
deploymentInput Type: DeploymentInput!
Field

updateClusterDeployment Type: Deployment

Update a deployment on a given cluster

Arguments
clusterID Type: ID!
deploymentID Type: ID!
deploymentInput Type: DeploymentInput!
Field

deleteClusterDeployment Type: Deleted

Delete a deployment on a given cluster

Arguments
clusterID Type: ID!
deploymentID Type: ID!
Field

createEndpoint Type: Endpoint

Create an endpoint for a given cluster

Arguments
clusterID Type: ID!
deploymentID Type: ID!
endpointInput Type: EndpointInput!
Field

updateEndpoint Type: Endpoint

Update an endpoint for a given cluster

Arguments
clusterID Type: ID!
deploymentID Type: ID!
endpointID Type: ID!
endpointInput Type: EndpointInput!
Field

deleteEndpoint Type: Deleted

Delete an endpoint for a given cluster

Arguments
clusterID Type: ID!
deploymentID Type: ID!
endpointID Type: ID!
Field

createRoleDeployment Type: Deployment

Create a deployment to be installed on every cluster of a given role. Only Secureworks admins can reach this endpoint.

Arguments
role Type: String!
deploymentInput Type: DeploymentInput!
Field

updateRoleDeployment Type: Deployment

Update a system deployment by ID. Only Secureworks admins can reach this endpoint.

Arguments
deploymentID Type: ID!
deploymentInput Type: DeploymentInput!
Field

deleteRoleDeployment Type: Deleted

Delete a system deployment by ID. Only Secureworks admins can reach this endpoint.

Arguments
deploymentID Type: ID!

Objects

Activation

Field

code Type: String

Field

id Type: String

Field

region Type: String

AggregateRateByCollector

The aggregate rate metrics structure represents a set of aggregated collector data flow rate metrics

Field

aggregateRate Type: PromMatrix

Selecting this field yields the rough equivalent of: sum(rate(collector_conversation_bytes[TimeRange]))[TimeRange]

BillOfMaterials

Field

location Type: String!

Chart

The chart structure represents the the attributes associated with a given helm chart

Field

apiVersion Type: String

Field

appVersion Type: String

Field

name Type: String

Field

description Type: String

Field

icon Type: String

Field

home Type: String

Field

keywords Type: [String!]

Field

version Type: String

Field

digest Type: String

Field

urls Type: [String!]

Field

metaData Type: Any

ChartList

The chart list structure represents a list of 'helm chart' entries available for installation in our repositories

Field

APIVersion Type: String

Field

Entries Type: Any

Field

Generated Type: Time

CloudRegion

Field

region Type: String!

Field

zones Type: [String!]

Cluster

The cluster structure represents the attributes of a data collector

Field

createdAt Type: Time

Field

updatedAt Type: Time

Field

id Type: ID!

Field

role Type: String

Field

name Type: String

Field

type Type: String

Field

clusterType Type: String

Field

description Type: String

Field

network Type: Network

Field

deployments Type: [Deployment!]

Field

status Type: [Status!]

Field

health Type: String

Field

healthState Type: String!

Field

registration Type: Registration

CollectorMetrics

The collector metrics structure represents a set of collector data metrics

Field

lastSeen Type: PromVector

Selecting this field yields the rough equivalent of: max(collector_last_seen) by (collector)

Field

averageRate Type: PromVector

Selecting this field yields the rough equivalent of: avg(rate(collector_conversation_bytes[TimeRange])) by (collector)

CollectorOverview

CollectorOverview combines a Cluster with its corresponding lastSeen and averageRate metrics. Check the CollectorMetrics type for more information on the latter.

Field

cluster Type: Cluster!

Field

lastSeen Type: PromSample

Field

averageRate Type: PromSample

Credentials

The credentials structure represents a set of credential attributes with regards to local access for a given collector

Field

password Type: String

Field

privateKey Type: String

Field

publicKey Type: String

DataSourceMetric

DataSourceMetric contains all of the relevant metadata to identify a log source as well as a 'lastSeen' timestamp which stores the last time that this log source was seen. A health status is also determined based on the recent ingest rate from this log source and how it compares to its historical ingest rate. 1 standard deviation away from the historical average is considered to be 'HEALTHY'. Anything greater than 1 but less than 2 standard deviations away is considered 'DEGRADED'. Anything greater than 2 standard deviations is considered 'UNHEALTHY'. If a health status cannot be determined due to an error or insufficient data then the returned health status will be 'UNKNOWN'.

Field

clusterID Type: ID!

Field

clusterName Type: String!

Field

sourceID Type: String!

Field

aliases Type: [String!]

Field

service Type: String!

Field

sensorTypes Type: [String!]!

Field

lastSeen Type: Time!

Field

health Type: String!

DataSourceMetrics

DataSourceMetrics holds log health data for all recorded log sources for a given collector

Field

metrics Type: [DataSourceMetric!]!

Deleted

Deleted represents a structure containing metadata related the action of deleting an arbitrary object

Field

type Type: String!

Field

id Type: String!

Field

successful Type: Boolean!

Deployment

Deployment defines helm package and config

Field

createdAt Type: Time

Field

updatedAt Type: Time

Field

id Type: ID!

Field

role Type: String

Field

name Type: String

Field

description Type: String

Field

chart Type: String

Field

version Type: String

Field

config Type: Map

Field

status Type: Status

Field

endpoints Type: [Endpoint!]

Endpoint

Endpoint defines API endpoints and credentials that applications would collect data from

Field

createdAt Type: Time

Field

updatedAt Type: Time

Field

id Type: ID!

Field

description Type: String

Field

address Type: String

Field

port Type: Int

Field

credentials Type: EndpointCredentials

FlowRate

The aggregate flow rate metrics structure represents a set of collector data flow rate metrics. Note that if custom host->address mappings, as returned by getHosts, are found they will be included or updated in the src_dns field.

Field

perFlowMax Type: PromVector

Selecting this field yields the rough equivalent of: max(collector_last_seen) by (src_host,dst_host,dst_port,host_addr,src_dns,proto)

Field

perFlowAverage Type: PromVector

Selecting this field yields the rough equivalent of: avg(rate(collector_conversation_bytes[TimeRange])) by (src_host,dst_host,dst_port,host_addr,src_dns,proto)

Image

Image represents the object that contains a given cluster's image metadata (such as an image download link)

Field

location Type: String!

LogLastSeenMetric

LogLastSeenMetric contains all of the relevant metadata to identify a log source as well as a 'lastSeen' timestamp which stores the last time that this log source was seen. A health status is also determined based on the recent ingest rate from this log source and how it compares to its historical ingest rate. 1 standard deviation away from the historical average is considered to be 'HEALTHY'. Anything greater than 1 but less than 2 standard deviations away is considered 'DEGRADED'. Anything greater than 2 standard deviations is considered 'UNHEALTHY'. If a health status cannot be determined due to an error or insufficient data then the returned health status will be 'UNKNOWN'.

Field

clusterID Type: ID!

Field

clusterName Type: String

Field

sourceID Type: String

Field

aliases Type: [String!]

Field

service Type: String

Field

sensorType Type: String

Field

lastSeen Type: Time

Field

health Type: String

LogLastSeenMetrics

LogLastSeenMetrics holds log health data for all recorded log sources for a given collector

Field

logMetrics Type: [LogLastSeenMetric!]

Network

The network structure represents the network configuration attributes for a given data collector

Field

dhcp Type: Boolean

Field

hostname Type: String

Field

hosts Type: Hosts

Field

address Type: String

Field

mask Type: String

Field

gateway Type: String

Field

dns Type: StringSlice

Field

ntp Type: StringSlice

Field

proxy Type: Proxy

OSConfig

Field

createdAt Type: Time!

Field

updatedAt Type: Time!

Field

clusterID Type: ID!

Field

status Type: ConfigStatus

Field

statusMessage Type: String

Field

dhcp Type: Boolean

Field

hostname Type: String!

Field

hosts Type: Hosts

Field

address Type: String!

Field

mask Type: String!

Field

gateway Type: String!

Field

dns Type: StringSlice

Field

ntp Type: StringSlice

Field

proxy Type: Proxy!

Registration

Registration represents the object that contains a given cluster's SSM id and region information

Field

id Type: ID

Field

region Type: String

Status

The status structure represents an overview of a collector's health and readiness status with regards to its own deployments

Field

name Type: String

Field

createdAt Type: Time

Field

updatedAt Type: Time

Field

id Type: ID!

Field

status Type: ChartStatus

System

Field

updatedAt Type: Time

Field

id Type: Int

Field

deployments Type: [Deployment!]

ValidityPeriod

Field

from Type: Uint

Field

until Type: Uint

Inputs

AWSDetails

The awsDetails input type contains the necessary identifying information for use with an AWS image download. Deprecated, use AWSDetailsV2 with getClusterImageV2.

Field

accountID Type: ID!

Field

region Type: String!

AWSDetailsV2

The awsDetails input type contains the necessary identifying information for use with an AWS image download. It is the strongly typed counterpart to AWSDetails.

Field

accountID Type: Uint!

Field

region Type: String!

ClusterImageInput

Input used to identify cluster image to download

Field

clusterID Type: ID!

Field

imageType Type: ImageType!

Field

launchConsole Type: Boolean

Field

awsDetails Type: AWSDetailsV2

Field

gcpDetails Type: GCPDetailsV2

ClusterInput

ClusterInput is the corresponding input type for a cluster object.

Field

name Type: String

Field

description Type: String

Field

network Type: NetworkInput

Field

role Type: String

Field

clusterType Type: ClusterType

Field

registration Type: RegistrationInput

DeploymentInput

DeploymentInput is the corresponding input type for a deployment object

Field

name Type: String

Field

description Type: String

Field

chart Type: String

Field

version Type: String

Field

config Type: Map

Field

endpoints Type: [EndpointInput!]

EndpointInput

EndpointInput is the corresponding input type for an endpoint object

Field

description Type: String

Field

address Type: String

Field

port Type: Int

Field

credentials Type: EndpointCredentials

GCPDetails

The gcpDetails input type contains the necessary identifying information for use with a GCP image download. Deprecated, use GCPDetailsV2 with getClusterImageV2.

Field

agentId Type: String!

Field

cidr Type: String!

Field

gcpProject Type: String!

Field

network Type: String!

Field

region Type: String!

Field

subnet Type: String!

Field

zone Type: String!

GCPDetailsV2

The gcpDetails input type contains the necessary identifying information for use with a GCP image download. It is the strongly typed counterpart to GCPDetails.

Field

agentId Type: EmailAddress!

Field

cidr Type: NetworkCIDR!

Field

gcpProject Type: String!

Field

network Type: String!

Field

region Type: String!

Field

subnet Type: String!

Field

zone Type: String!

GetDataSourceMetricsArguments

GetDataSourceMetricsArguments allows specifying filter arguments when calling GetDataSourceMetrics If no filters are specified, this will return all log sources metrics for all existing clusters and sources

Field

clusterId Type: ID

Field

sourceId Type: ID

HostsInput

The hosts input structure represents a set ip address->hostname mappings used by a data collector. These host alias mappings can be considered as analogous to an /etc/hosts file

Field

address Type: String!

Field

hostname Type: String!

NetworkInput

NetworkInput is the corresponding input type for a network object

Field

dhcp Type: Boolean

Field

hostname Type: String

Field

hosts Type: [HostsInput!]

Field

address Type: String

Field

mask Type: String

Field

gateway Type: String

Field

dns Type: [String!]

Field

ntp Type: [String!]

Field

proxy Type: Proxy

OSConfigInput

Field

clusterID Type: ID!

Field

status Type: ConfigStatus!

Field

statusMessage Type: String

Field

dhcp Type: Boolean

Field

hostname Type: String

Field

hosts Type: [HostsInput!]

Field

address Type: String

Field

mask Type: String

Field

gateway Type: String

Field

dns Type: [String!]

Field

ntp Type: [String!]

Field

proxy Type: Proxy

RegistrationInput

RegistrationInput is the corresponding input type for a registration object

Field

id Type: ID!

Field

region Type: String!

StatusInput

StatusInput is the corresponding input type for a status object

Field

deploymentID Type: String!

Field

name Type: String

Field

status Type: ChartStatus

Enums

ClusterType

ClusterType holds the available cluster type enums meant to represent whether a cluster is on prem or cloud hosted

ONPREM

CLOUD

ConfigStatus

CSNew

CSInflight

CSSuccess

CSFailed

ImageType

ImageType holds the available and supported collector image type enums

AMI

VHD

OVA

AZURE

GCP

RBACAction

READ

CREATE

UPDATE

DOWNLOAD

DELETE

TAG

LOGIN

CREDENTIALS

ENDPOINTCREDENTIALS

RBACObject

COLLECTOR

COLLECTORADMIN

DATASOURCE

TimeRange

TimeRange holds the available time range enums accepted by the prometheus query endpoints

LASTHOUR

LASTDAY

LAST3DAYS

LAST7DAYS

LAST30DAYS

Scalars

Any

Boolean

The Boolean scalar type represents true or false.

ChartStatus

'ChartStatus' is a custom scalar representing a map that holds chart status values with differewnt keys associated to chart name,version,status

DeploymentStatus

'DeploymentStatus' is a custom scalar representing a enum of helm status

EmailAddress

EmailAddress is a string type that must be of the 'foo@bar.com' or ' foo@bar.com' format

EndpointCredentials

Hosts

'Hosts' is a custom scalar representing a map type where the 'key' is the IP address and the 'value' is the list of associated hostnames

ID

The ID scalar type represents a unique identifier, often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as "4") or integer (such as 4) input value will be accepted as an ID.

Int

The Int scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1.

KubernetesConfig

'KubernetesConfig' is a custom scalar representing an arbitrary YAML formatted Kubernetes configuration

Map

NetworkCIDR

NetworkCIDR is a string type that must be of the standard '192.0.2.0/24' CIDR format

PromMatrix

'PromMatrix' is a custom scalar that is a one to one representation of the equivalent Prometheus API type you can find more information on in the link over 'Vector'. Matrix is currently only returned by one graphql endpoint.

PromSample

'PromSample' is a custom scalar that is a one to one representation of the equivalent Prometheus API type you can see here https://pkg.go.dev/github.com/prometheus/common/model?tab=doc#Sample . This type is returned by some Prometheus graphQL queries.

PromVector

'PromVector' is a custom scalar that is a one to one representation of the equivalent Prometheus API type you can see here https://pkg.go.dev/github.com/prometheus/common/model?tab=doc#Vector . This type is returned by numerous Prometheus graphQL queries.

Proxy

'proxy' is a custom scalar respresenting string value used for network proxy values. The following are all valid values for proxy https://auto:pass@autohostname.com:40,http://www.example.com,https://localhost:8080 https://localhost.test.com , https://test@t.com

String

The String scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.

StringSlice

Time

Uint

Uint is the 32 or 64 bit unsigned counterpart to Int

Interfaces

Node

Field

id Type: ID!