• • GraphQL Reference

• Queries

  • Query
  • Mutation

• Objects

  • Analytics
  • AnalyticsCubes
  • AnalyticsCubesDailyOnboardedPerformanceCube
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregate
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateAverage
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateConnection
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateCount
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateCountDistinct
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateEdge
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateMax
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateMin
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateSum
  • AnalyticsCubesDailyOnboardedPerformanceCubeConnection
  • AnalyticsCubesDailyOnboardedPerformanceCubeEdge
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCube
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregate
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateAverage
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateConnection
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateCount
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateCountDistinct
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateEdge
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateMax
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateMin
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateSum
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeConnection
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeEdge
  • AnalyticsCubesDailyUserTypeCountsSnapshot
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregate
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateAverage
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateConnection
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateCount
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateCountDistinct
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateEdge
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateMax
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateMin
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateSum
  • AnalyticsCubesDailyUserTypeCountsSnapshotConnection
  • AnalyticsCubesDailyUserTypeCountsSnapshotEdge
  • AnalyticsPluginFeedbackRulePassed
  • AnalyticsPluginFeedbackRulePassedAggregate
  • AnalyticsPluginFeedbackRulePassedAggregateConnection
  • AnalyticsPluginFeedbackRulePassedAggregateCount
  • AnalyticsPluginFeedbackRulePassedAggregateCountDistinct
  • AnalyticsPluginFeedbackRulePassedAggregateEdge
  • AnalyticsPluginFeedbackRulePassedAggregateMax
  • AnalyticsPluginFeedbackRulePassedAggregateMin
  • AnalyticsPluginFeedbackRulePassedConnection
  • AnalyticsPluginFeedbackRulePassedEdge
  • AnalyticsResponseFeedbackRuleActivated
  • AnalyticsResponseFeedbackRuleActivatedAggregate
  • AnalyticsResponseFeedbackRuleActivatedAggregateConnection
  • AnalyticsResponseFeedbackRuleActivatedAggregateCount
  • AnalyticsResponseFeedbackRuleActivatedAggregateCountDistinct
  • AnalyticsResponseFeedbackRuleActivatedAggregateEdge
  • AnalyticsResponseFeedbackRuleActivatedAggregateMax
  • AnalyticsResponseFeedbackRuleActivatedAggregateMin
  • AnalyticsResponseFeedbackRuleActivatedConnection
  • AnalyticsResponseFeedbackRuleActivatedEdge
  • AnalyticsResponseFeedbackRuleCreated
  • AnalyticsResponseFeedbackRuleCreatedAggregate
  • AnalyticsResponseFeedbackRuleCreatedAggregateConnection
  • AnalyticsResponseFeedbackRuleCreatedAggregateCount
  • AnalyticsResponseFeedbackRuleCreatedAggregateCountDistinct
  • AnalyticsResponseFeedbackRuleCreatedAggregateEdge
  • AnalyticsResponseFeedbackRuleCreatedAggregateMax
  • AnalyticsResponseFeedbackRuleCreatedAggregateMin
  • AnalyticsResponseFeedbackRuleCreatedConnection
  • AnalyticsResponseFeedbackRuleCreatedEdge
  • AnalyticsResponseFeedbackRuleDeactivated
  • AnalyticsResponseFeedbackRuleDeactivatedAggregate
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateConnection
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateCount
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateCountDistinct
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateEdge
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateMax
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateMin
  • AnalyticsResponseFeedbackRuleDeactivatedConnection
  • AnalyticsResponseFeedbackRuleDeactivatedEdge
  • AnalyticsResponseFeedbackRuleDeleted
  • AnalyticsResponseFeedbackRuleDeletedAggregate
  • AnalyticsResponseFeedbackRuleDeletedAggregateConnection
  • AnalyticsResponseFeedbackRuleDeletedAggregateCount
  • AnalyticsResponseFeedbackRuleDeletedAggregateCountDistinct
  • AnalyticsResponseFeedbackRuleDeletedAggregateEdge
  • AnalyticsResponseFeedbackRuleDeletedAggregateMax
  • AnalyticsResponseFeedbackRuleDeletedAggregateMin
  • AnalyticsResponseFeedbackRuleDeletedConnection
  • AnalyticsResponseFeedbackRuleDeletedEdge
  • AnalyticsResponseFeedbackRuleUpdated
  • AnalyticsResponseFeedbackRuleUpdatedAggregate
  • AnalyticsResponseFeedbackRuleUpdatedAggregateConnection
  • AnalyticsResponseFeedbackRuleUpdatedAggregateCount
  • AnalyticsResponseFeedbackRuleUpdatedAggregateCountDistinct
  • AnalyticsResponseFeedbackRuleUpdatedAggregateEdge
  • AnalyticsResponseFeedbackRuleUpdatedAggregateMax
  • AnalyticsResponseFeedbackRuleUpdatedAggregateMin
  • AnalyticsResponseFeedbackRuleUpdatedConnection
  • AnalyticsResponseFeedbackRuleUpdatedEdge
  • EmailAddress
  • EmailAttachment
  • EmailHeader
  • EmailName
  • EscalationEmail
  • FeedbackRule
  • FileResource
  • Game
  • Incident
  • IncidentEmailTemplate
  • IncidentEscalation
  • IncidentMatch
  • IncidentNote
  • IncidentRule
  • IncidentRuleActionChannels
  • IncidentRuleActionEmailChannel
  • IncidentRuleActionEmailChannelOptions
  • IncidentRuleEscalateAction
  • IncidentRuleMatch
  • IncidentRuleResolveAction
  • KeyValue
  • MlopsIocEmailMaliciousFlag
  • OrgUserCustomAttributeDefinitions
  • Organization
  • OrganizationAnalytics
  • PageInfo
  • Prediction
  • Quest
  • QuestEmail
  • QuestObjectiveEmail
  • QuestObjectiveGeneric
  • QuestObjectiveMarkers
  • QuestObjectiveQuiz
  • QuestObjectiveStars
  • QuestObjectives
  • QuestResult
  • SearchToken
  • SimulationSenderDomain
  • Threat
  • ThreatEmail
  • ThreatEmailAttachment
  • ThreatEmailHop
  • ThreatEmailLink
  • ThreatEnrichments
  • ThreatMetaData
  • ThreatObservable
  • ThreatResources
  • User
  • UserModifiers
  • UserProfile
  • UserTrainingPackage
  • UserTrainingPackageResult
  • __Directive
  • __EnumValue
  • __Field
  • __InputValue
  • __Schema
  • __Type

• Mutations

  • addIncidentNote
  • removeIncidentThreats
  • sendIncidentSocFeedback
  • setIncidentSensitive
  • setIncidentSocClassification
  • updateIncidentState

• Interfaces

  • IQuestObjective
  • IUserProfileName
  • Node

• Enums

  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateGroupBy
  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateOrderBy
  • AnalyticsCubesDailyOnboardedPerformanceCubeOrderBy
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateGroupBy
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateOrderBy
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeOrderBy
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateGroupBy
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateOrderBy
  • AnalyticsCubesDailyUserTypeCountsSnapshotOrderBy
  • AnalyticsPluginFeedbackRulePassedAggregateGroupBy
  • AnalyticsPluginFeedbackRulePassedAggregateOrderBy
  • AnalyticsPluginFeedbackRulePassedOrderBy
  • AnalyticsResponseFeedbackRuleActivatedAggregateGroupBy
  • AnalyticsResponseFeedbackRuleActivatedAggregateOrderBy
  • AnalyticsResponseFeedbackRuleActivatedOrderBy
  • AnalyticsResponseFeedbackRuleCreatedAggregateGroupBy
  • AnalyticsResponseFeedbackRuleCreatedAggregateOrderBy
  • AnalyticsResponseFeedbackRuleCreatedOrderBy
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateGroupBy
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateOrderBy
  • AnalyticsResponseFeedbackRuleDeactivatedOrderBy
  • AnalyticsResponseFeedbackRuleDeletedAggregateGroupBy
  • AnalyticsResponseFeedbackRuleDeletedAggregateOrderBy
  • AnalyticsResponseFeedbackRuleDeletedOrderBy
  • AnalyticsResponseFeedbackRuleUpdatedAggregateGroupBy
  • AnalyticsResponseFeedbackRuleUpdatedAggregateOrderBy
  • AnalyticsResponseFeedbackRuleUpdatedOrderBy
  • FeedbackRuleMessage
  • FeedbackRule_sort
  • IncidentMatch_sort
  • IncidentPolicy
  • IncidentRuleAction
  • IncidentRuleConditionTokenKey
  • IncidentRuleMatch_sort
  • IncidentRuleSettingsEmailTemplateType
  • IncidentRule_sort
  • IncidentState
  • IncidentViewSearchTokenKey
  • Incident_sort
  • LikelyTargetEntity
  • ONBOARDING_STATE
  • Organization_sort
  • QuestState
  • Quest_sort
  • SocClassification
  • ThreatClassification
  • ThreatIocMaliciousFlag
  • ThreatObservable_sort
  • ThreatSeverity
  • ThreatState
  • Threat_sort
  • USER_GAME_MODE
  • UserAction
  • User_sort
  • __DirectiveLocation
  • __TypeKind

• Unions

  • IncidentRuleActionUnion
  • MainObjective
  • SecondaryObjective

• Input Objects

  • AnalyticsCubesDailyOnboardedPerformanceCubeAggregateFilter
  • AnalyticsCubesDailyOnboardedPerformanceCubeFilter
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeAggregateFilter
  • AnalyticsCubesDailyOnboardedUserTrainingProgressCubeFilter
  • AnalyticsCubesDailyUserTypeCountsSnapshotAggregateFilter
  • AnalyticsCubesDailyUserTypeCountsSnapshotFilter
  • AnalyticsPluginFeedbackRulePassedAggregateFilter
  • AnalyticsPluginFeedbackRulePassedFilter
  • AnalyticsResponseFeedbackRuleActivatedAggregateFilter
  • AnalyticsResponseFeedbackRuleActivatedFilter
  • AnalyticsResponseFeedbackRuleCreatedAggregateFilter
  • AnalyticsResponseFeedbackRuleCreatedFilter
  • AnalyticsResponseFeedbackRuleDeactivatedAggregateFilter
  • AnalyticsResponseFeedbackRuleDeactivatedFilter
  • AnalyticsResponseFeedbackRuleDeletedAggregateFilter
  • AnalyticsResponseFeedbackRuleDeletedFilter
  • AnalyticsResponseFeedbackRuleUpdatedAggregateFilter
  • AnalyticsResponseFeedbackRuleUpdatedFilter
  • FeedbackRule_filter
  • IncidentMatch_filter
  • IncidentNoteInput
  • IncidentRuleMatch_filter
  • IncidentRule_filter
  • Incident_filter
  • Organization_filter
  • Quest_filter
  • ThreatObservable_filter
  • Threat_filter
  • UserTrainingPackage_filter
  • User_filter

• Scalars

  • Boolean
  • Cursor
  • Date
  • Float
  • ID
  • Int
  • SlackMessageAttachment
  • SlackMessageBlock
  • SlackMessageMetadata
  • String
  • Timestamp
  • WorkflowConfigConfig

• Directives

  • deprecated
  • external
  • include
  • skip

UserAction

Possible user actions from threats

Values

downloadedFile

enteredCredentials

forwardedEmail

openedAttachment

other

repliedToEmail

userActedOnThreat

userMarkedAsSpam

visitedLink