• • GraphQL Reference

• Queries

  • Query
  • Mutation

• Objects

  • Analytics
  • AnalyticsCubes
  • AnalyticsCubesDailyOnboardedPerformanceCube
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregate
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateAverage
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateConnection
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateCount
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateCountDistinct
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateEdge
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateMax
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateMin
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateSum
  • AnalyticsCubesDailyOnboardedPerformanceCubeConnection
  • AnalyticsCubesDailyOnboardedPerformanceCubeEdge
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCube
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregate
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateAverage
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateConnection
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateCount
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateCountDistinct
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateEdge
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateMax
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateMin
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateSum
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeConnection
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeEdge
  • AnalyticsCubesDailyUserTypeCountsSnapshot
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregate
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateAverage
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateConnection
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateCount
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateCountDistinct
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateEdge
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateMax
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateMin
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateSum
  • AnalyticsCubesDailyUserTypeCountsSnapshotConnection
  • AnalyticsCubesDailyUserTypeCountsSnapshotEdge
  • AnalyticsPluginFeedbackRulePassed
  • AnalyticsPluginFeedbackRulePassedAggregate
  • AnalyticsPluginFeedbackRulePassedAggregateConnection
  • AnalyticsPluginFeedbackRulePassedAggregateCount
  • AnalyticsPluginFeedbackRulePassedAggregateCountDistinct
  • AnalyticsPluginFeedbackRulePassedAggregateEdge
  • AnalyticsPluginFeedbackRulePassedAggregateMax
  • AnalyticsPluginFeedbackRulePassedAggregateMin
  • AnalyticsPluginFeedbackRulePassedConnection
  • AnalyticsPluginFeedbackRulePassedEdge
  • EmailAddress
  • EmailAttachment
  • EmailHeader
  • EmailName
  • EscalationEmail
  • FileResource
  • Game
  • Incident
  • IncidentEmailTemplate
  • IncidentEscalation
  • IncidentMatch
  • IncidentNote
  • IncidentRule
  • IncidentRuleActionChannels
  • IncidentRuleActionEmailChannel
  • IncidentRuleActionEmailChannelOptions
  • IncidentRuleEscalateAction
  • IncidentRuleResolveAction
  • KeyValue
  • MlopsIocEmailMaliciousFlag
  • OrgUserCustomAttributeDefinitions
  • Organization
  • OrganizationAnalytics
  • PageInfo
  • Prediction
  • Quest
  • QuestEmail
  • QuestObjectiveEmail
  • QuestObjectiveGeneric
  • QuestObjectiveMarkers
  • QuestObjectiveQuiz
  • QuestObjectiveStars
  • QuestObjectives
  • QuestResult
  • SearchToken
  • Threat
  • ThreatEmail
  • ThreatEmailAttachment
  • ThreatEmailHop
  • ThreatEmailLink
  • ThreatEnrichments
  • ThreatObservable
  • User
  • UserModifiers
  • UserProfile
  • UserTrainingPackage
  • UserTrainingPackageResult
  • __Directive
  • __EnumValue
  • __Field
  • __InputValue
  • __Schema
  • __Type

• Mutations

  • addIncidentNote
  • removeIncidentThreats
  • sendIncidentSocFeedback
  • setIncidentSensitive
  • setIncidentSocClassification
  • updateIncidentState

• Interfaces

  • IQuestObjective
  • IUserProfileName
  • Node

• Enums

  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateGroupBy
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateOrderBy
  • AnalyticsCubesDailyOnboardedPerformanceCubeOrderBy
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateGroupBy
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateOrderBy
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeOrderBy
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateGroupBy
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateOrderBy
  • AnalyticsCubesDailyUserTypeCountsSnapshotOrderBy
  • AnalyticsPluginFeedbackRulePassedAggregateGroupBy
  • AnalyticsPluginFeedbackRulePassedAggregateOrderBy
  • AnalyticsPluginFeedbackRulePassedOrderBy
  • IncidentMatch_sort
  • IncidentPolicy
  • IncidentRuleAction
  • IncidentRuleSettingsEmailTemplateType
  • IncidentRule_sort
  • IncidentState
  • Incident_sort
  • ONBOARDING_STATE
  • Organization_sort
  • QuestState
  • Quest_sort
  • SocClassification
  • ThreatClassification
  • ThreatIocMaliciousFlag
  • ThreatObservable_sort
  • ThreatSeverity
  • ThreatState
  • Threat_sort
  • USER_GAME_MODE
  • User_sort
  • __DirectiveLocation
  • __TypeKind

• Unions

  • IncidentRuleActionUnion
  • MainObjective
  • SecondaryObjective

• Input Objects

  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateFilter
  • AnalyticsCubesDailyOnboardedPerformanceCubeFilter
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateFilter
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeFilter
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateFilter
  • AnalyticsCubesDailyUserTypeCountsSnapshotFilter
  • AnalyticsPluginFeedbackRulePassedAggregateFilter
  • AnalyticsPluginFeedbackRulePassedFilter
  • IncidentMatch_filter
  • IncidentNoteInput
  • IncidentRule_filter
  • Incident_filter
  • Organization_filter
  • Quest_filter
  • ThreatObservable_filter
  • Threat_filter
  • UserTrainingPackage_filter
  • User_filter

• Scalars

  • Boolean
  • Cursor
  • Date
  • Float
  • ID
  • Int
  • SlackMessageAttachment
  • SlackMessageBlock
  • SlackMessageMetadata
  • String
  • Timestamp
  • WorkflowConfigConfig

• Directives

  • deprecated
  • external
  • include
  • skip

ThreatSeverity

Possible severity levels while categorising threats

Values

INCONCLUSIVE

FALSE_POSITIVE

SPAM

PHISH

SPEAR

COMPROMISED_EMAIL