• • GraphQL Reference

• Operations

  • Query
  • Mutation

• Queries

  • currentUser
  • feedbackRules
  • incidents
  • organizations
  • quests
  • threatObservables
  • threats
  • users

• Mutations

  • addIncidentNote
  • removeIncidentThreats
  • sendIncidentSocFeedback
  • setIncidentSensitive
  • setIncidentSocClassification
  • updateIncidentState

• Objects

  • Analytics
  • AnalyticsCubes
  • AnalyticsCubesDailyOnboardedPerformanceCube
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregate
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateAverage
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateConnection
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateCount
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateCountDistinct
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateEdge
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateMax
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateMin
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateSum
  • AnalyticsCubesDailyOnboardedPerformanceCubeConnection
  • AnalyticsCubesDailyOnboardedPerformanceCubeEdge
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCube
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregate
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateAverage
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateConnection
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateCount
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateCountDistinct
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateEdge
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateMax
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateMin
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateSum
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeConnection
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeEdge
  • AnalyticsCubesDailyUserTypeCountsSnapshot
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregate
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateAverage
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateConnection
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateCount
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateCountDistinct
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateEdge
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateMax
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateMin
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateSum
  • AnalyticsCubesDailyUserTypeCountsSnapshotConnection
  • AnalyticsCubesDailyUserTypeCountsSnapshotEdge
  • AnalyticsPluginFeedbackRulePassed
  • AnalyticsPluginFeedbackRulePassedAggregate
  • AnalyticsPluginFeedbackRulePassedAggregateConnection
  • AnalyticsPluginFeedbackRulePassedAggregateCount
  • AnalyticsPluginFeedbackRulePassedAggregateCountDistinct
  • AnalyticsPluginFeedbackRulePassedAggregateEdge
  • AnalyticsPluginFeedbackRulePassedAggregateMax
  • AnalyticsPluginFeedbackRulePassedAggregateMin
  • AnalyticsPluginFeedbackRulePassedConnection
  • AnalyticsPluginFeedbackRulePassedEdge
  • AnalyticsResponseFeedbackRuleActivated
  • AnalyticsResponseFeedbackRuleActivatedAggregate
  • AnalyticsResponseFeedbackRuleActivatedAggregateConnection
  • AnalyticsResponseFeedbackRuleActivatedAggregateCount
  • AnalyticsResponseFeedbackRuleActivatedAggregateCountDistinct
  • AnalyticsResponseFeedbackRuleActivatedAggregateEdge
  • AnalyticsResponseFeedbackRuleActivatedAggregateMax
  • AnalyticsResponseFeedbackRuleActivatedAggregateMin
  • AnalyticsResponseFeedbackRuleActivatedConnection
  • AnalyticsResponseFeedbackRuleActivatedEdge
  • AnalyticsResponseFeedbackRuleCreated
  • AnalyticsResponseFeedbackRuleCreatedAggregate
  • AnalyticsResponseFeedbackRuleCreatedAggregateConnection
  • AnalyticsResponseFeedbackRuleCreatedAggregateCount
  • AnalyticsResponseFeedbackRuleCreatedAggregateCountDistinct
  • AnalyticsResponseFeedbackRuleCreatedAggregateEdge
  • AnalyticsResponseFeedbackRuleCreatedAggregateMax
  • AnalyticsResponseFeedbackRuleCreatedAggregateMin
  • AnalyticsResponseFeedbackRuleCreatedConnection
  • AnalyticsResponseFeedbackRuleCreatedEdge
  • AnalyticsResponseFeedbackRuleDeactivated
  • AnalyticsResponseFeedbackRuleDeactivatedAggregate
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateConnection
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateCount
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateCountDistinct
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateEdge
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateMax
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateMin
  • AnalyticsResponseFeedbackRuleDeactivatedConnection
  • AnalyticsResponseFeedbackRuleDeactivatedEdge
  • AnalyticsResponseFeedbackRuleDeleted
  • AnalyticsResponseFeedbackRuleDeletedAggregate
  • AnalyticsResponseFeedbackRuleDeletedAggregateConnection
  • AnalyticsResponseFeedbackRuleDeletedAggregateCount
  • AnalyticsResponseFeedbackRuleDeletedAggregateCountDistinct
  • AnalyticsResponseFeedbackRuleDeletedAggregateEdge
  • AnalyticsResponseFeedbackRuleDeletedAggregateMax
  • AnalyticsResponseFeedbackRuleDeletedAggregateMin
  • AnalyticsResponseFeedbackRuleDeletedConnection
  • AnalyticsResponseFeedbackRuleDeletedEdge
  • AnalyticsResponseFeedbackRuleUpdated
  • AnalyticsResponseFeedbackRuleUpdatedAggregate
  • AnalyticsResponseFeedbackRuleUpdatedAggregateConnection
  • AnalyticsResponseFeedbackRuleUpdatedAggregateCount
  • AnalyticsResponseFeedbackRuleUpdatedAggregateCountDistinct
  • AnalyticsResponseFeedbackRuleUpdatedAggregateEdge
  • AnalyticsResponseFeedbackRuleUpdatedAggregateMax
  • AnalyticsResponseFeedbackRuleUpdatedAggregateMin
  • AnalyticsResponseFeedbackRuleUpdatedConnection
  • AnalyticsResponseFeedbackRuleUpdatedEdge
  • AnalyticsResponseRemediationDeletionStarted
  • AnalyticsResponseRemediationDeletionStartedAggregate
  • AnalyticsResponseRemediationDeletionStartedAggregateAverage
  • AnalyticsResponseRemediationDeletionStartedAggregateConnection
  • AnalyticsResponseRemediationDeletionStartedAggregateCount
  • AnalyticsResponseRemediationDeletionStartedAggregateCountDistinct
  • AnalyticsResponseRemediationDeletionStartedAggregateEdge
  • AnalyticsResponseRemediationDeletionStartedAggregateMax
  • AnalyticsResponseRemediationDeletionStartedAggregateMin
  • AnalyticsResponseRemediationDeletionStartedAggregateSum
  • AnalyticsResponseRemediationDeletionStartedConnection
  • AnalyticsResponseRemediationDeletionStartedEdge
  • AnalyticsResponseRemediationRevertStarted
  • AnalyticsResponseRemediationRevertStartedAggregate
  • AnalyticsResponseRemediationRevertStartedAggregateAverage
  • AnalyticsResponseRemediationRevertStartedAggregateConnection
  • AnalyticsResponseRemediationRevertStartedAggregateCount
  • AnalyticsResponseRemediationRevertStartedAggregateCountDistinct
  • AnalyticsResponseRemediationRevertStartedAggregateEdge
  • AnalyticsResponseRemediationRevertStartedAggregateMax
  • AnalyticsResponseRemediationRevertStartedAggregateMin
  • AnalyticsResponseRemediationRevertStartedAggregateSum
  • AnalyticsResponseRemediationRevertStartedConnection
  • AnalyticsResponseRemediationRevertStartedEdge
  • AnalyticsResponseSdEmailSearchStarted
  • AnalyticsResponseSdEmailSearchStartedAggregate
  • AnalyticsResponseSdEmailSearchStartedAggregateConnection
  • AnalyticsResponseSdEmailSearchStartedAggregateCount
  • AnalyticsResponseSdEmailSearchStartedAggregateCountDistinct
  • AnalyticsResponseSdEmailSearchStartedAggregateEdge
  • AnalyticsResponseSdEmailSearchStartedAggregateMax
  • AnalyticsResponseSdEmailSearchStartedAggregateMin
  • AnalyticsResponseSdEmailSearchStartedConnection
  • AnalyticsResponseSdEmailSearchStartedEdge
  • EmailAddress
  • EmailAttachment
  • EmailHeader
  • EmailName
  • EscalationEmail
  • FeedbackRule
  • FileResource
  • Game
  • IcuMessage
  • Incident
  • IncidentEmailTemplate
  • IncidentEscalation
  • IncidentMatch
  • IncidentNote
  • IncidentRule
  • IncidentRuleActionChannels
  • IncidentRuleActionEmailChannel
  • IncidentRuleActionEmailChannelOptions
  • IncidentRuleEscalateAction
  • IncidentRuleMatch
  • IncidentRuleResolveAction
  • KeyValue
  • MlopsIocEmailMaliciousFlag
  • OrgUserCustomAttributeDefinitions
  • Organization
  • OrganizationAnalytics
  • OrganizationLegacyContract
  • OrganizationModernContract
  • PageInfo
  • Prediction
  • Quest
  • QuestEmail
  • QuestObjectiveEmail
  • QuestObjectiveGeneric
  • QuestObjectiveMarkers
  • QuestObjectiveQuiz
  • QuestObjectiveStars
  • QuestObjectives
  • QuestResult
  • SearchToken
  • SimulationSenderDomain
  • Threat
  • ThreatEmail
  • ThreatEmailAttachment
  • ThreatEmailHop
  • ThreatEmailLink
  • ThreatEnrichments
  • ThreatMetaData
  • ThreatObservable
  • ThreatResources
  • User
  • UserModifiers
  • UserProfile
  • UserTrainingPackage
  • UserTrainingPackageResult
  • __Directive
  • __EnumValue
  • __Field
  • __InputValue
  • __Schema
  • __Type

• Interfaces

  • IQuestObjective
  • IUserProfileName
  • Node

• Enums

  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateGroupBy
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateOrderBy
  • AnalyticsCubesDailyOnboardedPerformanceCubeOrderBy
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateGroupBy
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateOrderBy
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeOrderBy
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateGroupBy
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateOrderBy
  • AnalyticsCubesDailyUserTypeCountsSnapshotOrderBy
  • AnalyticsPluginFeedbackRulePassedAggregateGroupBy
  • AnalyticsPluginFeedbackRulePassedAggregateOrderBy
  • AnalyticsPluginFeedbackRulePassedOrderBy
  • AnalyticsResponseFeedbackRuleActivatedAggregateGroupBy
  • AnalyticsResponseFeedbackRuleActivatedAggregateOrderBy
  • AnalyticsResponseFeedbackRuleActivatedOrderBy
  • AnalyticsResponseFeedbackRuleCreatedAggregateGroupBy
  • AnalyticsResponseFeedbackRuleCreatedAggregateOrderBy
  • AnalyticsResponseFeedbackRuleCreatedOrderBy
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateGroupBy
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateOrderBy
  • AnalyticsResponseFeedbackRuleDeactivatedOrderBy
  • AnalyticsResponseFeedbackRuleDeletedAggregateGroupBy
  • AnalyticsResponseFeedbackRuleDeletedAggregateOrderBy
  • AnalyticsResponseFeedbackRuleDeletedOrderBy
  • AnalyticsResponseFeedbackRuleUpdatedAggregateGroupBy
  • AnalyticsResponseFeedbackRuleUpdatedAggregateOrderBy
  • AnalyticsResponseFeedbackRuleUpdatedOrderBy
  • AnalyticsResponseRemediationDeletionStartedAggregateGroupBy
  • AnalyticsResponseRemediationDeletionStartedAggregateOrderBy
  • AnalyticsResponseRemediationDeletionStartedOrderBy
  • AnalyticsResponseRemediationRevertStartedAggregateGroupBy
  • AnalyticsResponseRemediationRevertStartedAggregateOrderBy
  • AnalyticsResponseRemediationRevertStartedOrderBy
  • AnalyticsResponseSdEmailSearchStartedAggregateGroupBy
  • AnalyticsResponseSdEmailSearchStartedAggregateOrderBy
  • AnalyticsResponseSdEmailSearchStartedOrderBy
  • ExternalSchemaLicensedResource
  • FeedbackRuleMessage
  • FeedbackRule_sort
  • IncidentMatch_sort
  • IncidentPolicy
  • IncidentRuleAction
  • IncidentRuleConditionTokenKey
  • IncidentRuleMatch_sort
  • IncidentRuleSettingsEmailTemplateType
  • IncidentRule_sort
  • IncidentState
  • IncidentViewSearchTokenKey
  • Incident_sort
  • LikelyTargetEntity
  • ONBOARDING_STATE
  • OrganizationTier
  • Organization_sort
  • QuestState
  • Quest_sort
  • SocClassification
  • SortOrder
  • ThreatChannel
  • ThreatClassification
  • ThreatIocMaliciousFlag
  • ThreatObservable_sort
  • ThreatSeverity
  • ThreatState
  • Threat_sort
  • USER_GAME_MODE
  • UserAction
  • User_sort
  • __DirectiveLocation
  • __TypeKind

• Unions

  • IncidentRuleActionUnion
  • MainObjective
  • OrganizationContract
  • SecondaryObjective

• Input Objects

  • AggregateIntFilter
  • AggregateStringFilter
  • AggregateTimestampFilter
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateFilter
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateInput
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateInputFilter
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateInputOrderBy
  • AnalyticsCubesDailyOnboardedPerformanceCubeFilter
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateFilter
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateInput
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateInputFilter
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateInputOrderBy
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeFilter
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateFilter
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateInput
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateInputFilter
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateInputOrderBy
  • AnalyticsCubesDailyUserTypeCountsSnapshotFilter
  • AnalyticsPluginFeedbackRulePassedAggregateFilter
  • AnalyticsPluginFeedbackRulePassedAggregateInput
  • AnalyticsPluginFeedbackRulePassedAggregateInputFilter
  • AnalyticsPluginFeedbackRulePassedAggregateInputOrderBy
  • AnalyticsPluginFeedbackRulePassedFilter
  • AnalyticsResponseFeedbackRuleActivatedAggregateFilter
  • AnalyticsResponseFeedbackRuleActivatedAggregateInput
  • AnalyticsResponseFeedbackRuleActivatedAggregateInputFilter
  • AnalyticsResponseFeedbackRuleActivatedAggregateInputOrderBy
  • AnalyticsResponseFeedbackRuleActivatedFilter
  • AnalyticsResponseFeedbackRuleCreatedAggregateFilter
  • AnalyticsResponseFeedbackRuleCreatedAggregateInput
  • AnalyticsResponseFeedbackRuleCreatedAggregateInputFilter
  • AnalyticsResponseFeedbackRuleCreatedAggregateInputOrderBy
  • AnalyticsResponseFeedbackRuleCreatedFilter
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateFilter
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateInput
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateInputFilter
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateInputOrderBy
  • AnalyticsResponseFeedbackRuleDeactivatedFilter
  • AnalyticsResponseFeedbackRuleDeletedAggregateFilter
  • AnalyticsResponseFeedbackRuleDeletedAggregateInput
  • AnalyticsResponseFeedbackRuleDeletedAggregateInputFilter
  • AnalyticsResponseFeedbackRuleDeletedAggregateInputOrderBy
  • AnalyticsResponseFeedbackRuleDeletedFilter
  • AnalyticsResponseFeedbackRuleUpdatedAggregateFilter
  • AnalyticsResponseFeedbackRuleUpdatedAggregateInput
  • AnalyticsResponseFeedbackRuleUpdatedAggregateInputFilter
  • AnalyticsResponseFeedbackRuleUpdatedAggregateInputOrderBy
  • AnalyticsResponseFeedbackRuleUpdatedFilter
  • AnalyticsResponseRemediationDeletionStartedAggregateFilter
  • AnalyticsResponseRemediationDeletionStartedAggregateInput
  • AnalyticsResponseRemediationDeletionStartedAggregateInputFilter
  • AnalyticsResponseRemediationDeletionStartedAggregateInputOrderBy
  • AnalyticsResponseRemediationDeletionStartedFilter
  • AnalyticsResponseRemediationRevertStartedAggregateFilter
  • AnalyticsResponseRemediationRevertStartedAggregateInput
  • AnalyticsResponseRemediationRevertStartedAggregateInputFilter
  • AnalyticsResponseRemediationRevertStartedAggregateInputOrderBy
  • AnalyticsResponseRemediationRevertStartedFilter
  • AnalyticsResponseSdEmailSearchStartedAggregateFilter
  • AnalyticsResponseSdEmailSearchStartedAggregateInput
  • AnalyticsResponseSdEmailSearchStartedAggregateInputFilter
  • AnalyticsResponseSdEmailSearchStartedAggregateInputOrderBy
  • AnalyticsResponseSdEmailSearchStartedFilter
  • FeedbackRule_filter
  • FloatFilter
  • IncidentMatch_filter
  • IncidentNoteInput
  • IncidentRuleMatch_filter
  • IncidentRule_filter
  • Incident_filter
  • IntAggregateOrderBy
  • IntFilter
  • Organization_filter
  • Quest_filter
  • StringAggregateOrderBy
  • StringFilter
  • ThreatObservable_filter
  • Threat_filter
  • TimestampAggregateOrderBy
  • TimestampFilter
  • UserTrainingPackage_filter
  • User_filter

• Scalars

  • Boolean
  • Cursor
  • Date
  • Float
  • ID
  • Int
  • SlackMessageAttachment
  • SlackMessageBlock
  • SlackMessageMetadata
  • String
  • Timestamp
  • WorkflowConfigConfig

• Directives

  • deprecated
  • external
  • include
  • licensed
  • oneOf
  • skip
  • specifiedBy

UserAction

Possible user actions from threats

Values

downloadedFile

enteredCredentials

forwardedEmail

openedAttachment

other

repliedToEmail

userActedOnThreat

userMarkedAsSpam

visitedLink