The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}}}}}}}
```
## The vpc\_config\_aws\_s3 object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"vpc_config_aws_s3":{"description":"AWS S3 Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","bucket","bucketregion","region","awsauthtype"],"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["aws"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["s3"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow","dns"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"bucket":{"type":"string","description":"S3 bucket"},"bucketregion":{"type":"string","description":"Region this S3 bucket is in."},"hive":{"type":"string","description":"S3 Hive-compatible prefix"},"prefix":{"type":"string","description":"S3 flow log path prefix"},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"sqsurl":{"type":"string","description":"SQS URL of S3 events"},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}},"vpcid":{"description":"VPC ID of the source, applicable and required only for dns traffictype","type":"string"}}}}}}
```
## The vpc\_config\_azure\_blobstorage object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"vpc_config_azure_blobstorage":{"description":"Azure Blobstorage Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","region","accountname","accountkey","containername","networksecuritygroup","resourcegroup","subscriptionid"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["azure"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["blobstorage"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"accountname":{"type":"string","description":"Azure Storage Account's Access Name"},"accountkey":{"type":"string","description":"Azure Storage Account's Access Key"},"containername":{"type":"string","description":"Azure Storage Account's Container Name"},"networksecuritygroup":{"type":"string","description":"Azure Network Security Group's Name"},"resourcegroup":{"type":"string","description":"Azure Network Security Group's Resource Group"},"subscriptionid":{"type":"string","description":"Azure Network Security Group's subscription ID"},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}}}}}}}
```
## The vpc\_config\_gcp object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"vpc_config_gcp":{"description":"GCP PubSub Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","projectid","subid"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["gcp"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["pubsub"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow","dns"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"projectid":{"type":"string","description":"GCP Project ID"},"subid":{"type":"string","description":"GCP PubSub Subscription ID"},"samplepercent":{"description":"Sample Rate Percent","type":"integer","format":"int32","minimum":1,"maximum":100},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}}}}}}}
```
## The vpc\_config\_ibm\_objectstorage object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"vpc_config_ibm_objectstorage":{"description":"IBM Objectstorage Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","region","apikey","bucket","serviceinstanceid"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["ibm"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["objectstorage"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"apikey":{"type":"string","description":"IBM Objectstorage API key that is associated for the Service ID."},"bucket":{"type":"string","description":"The Objectstorage bucket name."},"prefix":{"type":"string","description":"Flow log path prefix"},"serviceinstanceid":{"type":"string","description":"Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential."},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}}}}}}}
```
## The vpc\_config\_oracle\_objectstorage object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"vpc_config_oracle_objectstorage":{"description":"Oracle Objectstorage Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","region","bucket","tenancy","userid"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["oracle"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["objectstorage"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"bucket":{"type":"string","description":"The Oracle Objectstorage bucket name."},"tenancy":{"type":"string","description":"Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID)."},"userid":{"type":"string","description":"Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID)."},"prefix":{"type":"string","description":"Optional folder prefix"},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}}}}}}}
```
## The vpc\_config\_azure\_vnet\_blobstorage object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"vpc_config_azure_vnet_blobstorage":{"description":"Azure VNet Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","region","accountname","accountkey","containername","networkwatcher","resourcegroup","subscriptionid","flowlog"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["azure-vnet"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["blobstorage"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow"]},"name":{"description":"The name of this flow source in Netography Fusion. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"Enable or disable polling the cloud provider for samples","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"Virtual Network Region in Azure region format (lowercase with no spaces). Examples: eastus, centralus, westus2. See Get VPC regions by flowtype for a list of valid regions.\n"},"accountname":{"type":"string","description":"Azure Storage Account Name where flow logs are stored"},"accountkey":{"type":"string","description":"Azure Storage Account's Access Key"},"containername":{"type":"string","description":"Azure Storage Account's Container Name. Use default of insights-logs-flowlogflowevent. Do not include leading spaces in the value.\n"},"networkwatcher":{"type":"string","description":"Azure Network Watcher's Name. Usually in format NetworkWatcher_region (e.g. NetworkWatcher_eastus).\n"},"resourcegroup":{"type":"string","description":"Azure Network Watcher's Resource Group. Use default of NETWORKWATCHERRG. Do not change unless you know what you're doing.\n"},"flowlog":{"type":"string","description":"Flow Log Name as shown in Network Watcher in Azure. This is a required field that identifies the specific flow log to collect.\n"},"subscriptionid":{"type":"string","description":"Network Watcher Subscription ID"},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}}}}}}}
```
## The integrations\_context\_aws object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context_aws":{"type":"object","description":"Configuration options specific to type aws. nil if not configuring AWS","required":["awsauthtype","region"],"additionalProperties":false,"properties":{"region":{"type":"string","description":"The aws region to authenticate to"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in AWS"},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}}}}}}}
```
## The integrations\_context\_azure object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context_azure":{"type":"object","description":"Configuration options specific to type azure. nil if not configuring Azure","required":["clientid","clientsecret","subscriptionid","tenantid"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to use authenticating with azure","type":"string"},"clientsecret":{"description":"The client secret to use authenticating with azure","type":"string"},"subscriptionid":{"type":"string","description":"The azure subscription id to be queried"},"tenantid":{"type":"string","description":"The azure tenant id to use"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in Azure"}}}}}}
```
## The integrations\_context\_crowdstrike object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context_crowdstrike":{"type":"object","description":"Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.","required":["clientid","clientsecret","cloud"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to authenticate to the Falcon cloud api","type":"string"},"clientsecret":{"description":"The client secret to authenticate to the Falcon cloud api","type":"string"},"cloud":{"type":"string","description":"The Falcon cloud abbreviation to query","enum":["us-1","us-2","eu-1","us-gov-1"]},"filter":{"type":"string","description":"An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d"},"sort":{"type":"string","description":"An optional FQL sort string, e.g. last_seen_timestamp.desc"}}}}}}
```
## The integrations\_context\_crowdstrikediscover object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context_crowdstrikediscover":{"type":"object","description":"Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.","required":["clientid","clientsecret","cloud"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to authenticate to the Falcon cloud api","type":"string"},"clientsecret":{"description":"The client secret to authenticate to the Falcon cloud api","type":"string"},"cloud":{"type":"string","description":"The Falcon cloud abbreviation to query","enum":["us-1","us-2","eu-1","us-gov-1"]},"filter":{"type":"string","description":"An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d"},"sort":{"type":"string","description":"An optional FQL sort string, e.g. last_seen_timestamp.desc"}}}}}}
```
## The integrations\_context\_ibm object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context_ibm":{"type":"object","description":"Configuration options specific to ibm. nil if not configuring IBM Cloud","required":["apikey","region"],"properties":{"apikey":{"description":"The api key to use for authentication","type":"string"},"region":{"type":"string","description":"The IBM region to query"}}}}}}
```
## The integrations\_context\_oracle object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context_oracle":{"type":"object","description":"Configuration options specific to oracle. nil if not configuring Oracle Cloud","required":["user","tenancy","region"],"additionalProperties":false,"properties":{"user":{"description":"The user ocid to use for authentication to oracle cloud","type":"string"},"tenancy":{"description":"The tenancy ocid to use for connecting to oracle cloud","type":"string"},"region":{"type":"string","description":"The region of oracle cloud to connect to"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in oracle cloud"}}}}}}
```
## The integrations\_context\_gcp object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context_gcp":{"type":"object","description":"Configuration options specific to gcp. nil if not configuring GCP","required":["zone","credentials"],"additionalProperties":false,"properties":{"zone":{"description":"The GCP zone for this configuration","type":"string"},"credentials":{"type":"object","description":"The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.","additionalProperties":false,"required":["type","project_id","private_key_id","private_key","client_email","client_id","auth_uri","token_uri","auth_provider_x509_cert_url","client_x509_cert_url"],"properties":{"type":{"type":"string","description":"Credential type. this will typically be \"service_account\""},"project_id":{"type":"string","description":"The project id of the account"},"private_key_id":{"type":"string","description":"The private key id of the service account"},"private_key":{"type":"string","description":"The pirvate key to authenticate with"},"client_email":{"type":"string","description":"The email of the service account"},"client_id":{"type":"string","description":"The id of the client"},"auth_uri":{"type":"string","description":"OAth2 uri"},"token_uri":{"type":"string","description":"Token URI"},"auth_provider_x509_cert_url":{"type":"string","description":"Auth cert url"},"client_x509_cert_url":{"type":"string","description":"Client cert url"}}},"labels":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom label names to track in GCP"}}}}}}
```
## The integrations\_context\_s3 object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context_s3":{"type":"object","description":"Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n","required":["awsauthtype","region","bucket"],"additionalProperties":false,"properties":{"region":{"type":"string","description":"The aws region to authenticate to"},"bucket":{"type":"string","description":"The name of the s3 bucket from which to pull the csv file."},"path":{"type":"string","description":"The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..."},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}}}}}}}
```
## The integrations\_context\_sentinelone object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context_sentinelone":{"type":"object","description":"Configuration options specific to sentinelone. nil if not configuring SentinelOne","required":["base_url","params","token"],"additionalProperties":false,"properties":{"base_url":{"description":"The SentinelOne domain URL to query, e.g. https://.sentinelone.net ","type":"string"},"params":{"type":"object","additionalProperties":false,"properties":{"accountId":{"type":"string","description":"The SentinelOne account ID to query"},"filterId":{"type":"string","description":"The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000"}}},"token":{"description":"API token to use for authentication","type":"string"},"ranger":{"type":"object","properties":{"enabled":{"type":"boolean"}}}}}}}}
```
## The integrations\_context\_wiz object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context_wiz":{"type":"object","description":"Configuration options specific to wiz. nil if not configuring Wiz","required":["apiendpoint","tokenurl","clientid","clientsecret"],"additionalProperties":false,"properties":{"apiendpoint":{"description":"Wiz API Endpoint URL","type":"string","enum":["https://api.us1.app.wiz.io/graphql","https://api.us2.app.wiz.io/graphql","https://api.eu1.app.wiz.io/graphql","https://api.eu2.app.wiz.io/graphql","https://api.us17.app.wiz.io/graphql"]},"tokenurl":{"description":"Wiz Token URL","type":"string","enum":["https://auth.app.wiz.io/oauth/token","https://auth.wiz.io/oauth/token","https://auth.gov.wiz.io/oauth/token","https://auth0.gov.wiz.io/oauth/token"]},"clientid":{"description":"Client id to use authenticating with Wiz API","type":"string"},"clientsecret":{"description":"Client secret to use authenticating with Wiz API","type":"string"}}}}}}
```
## The integrations\_context object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_context":{"description":"List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.","type":"object","required":["name","type","enabled","updateinterval"],"allOf":[{"type":"object","properties":{"name":{"type":"string","description":"The name of the context integration"},"type":{"type":"string","description":"The type of the context integration. The configuration parameters are dependent on this value.","enum":["aws","azure","crowdstrike","crowdstrikediscover","ibm","oracle","gcp","s3"]},"enabled":{"type":"boolean","description":"The state of the context integration. Whether to auto update or not."},"updateinterval":{"type":"integer","description":"The number of seconds by which to poll the integration.","minimum":3600,"maximum":604800,"format":"int32"},"aws":{"type":"object","description":"Configuration options specific to type aws. nil if not configuring AWS","required":["awsauthtype","region"],"additionalProperties":false,"properties":{"region":{"type":"string","description":"The aws region to authenticate to"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in AWS"},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}}}},"azure":{"type":"object","description":"Configuration options specific to type azure. nil if not configuring Azure","required":["clientid","clientsecret","subscriptionid","tenantid"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to use authenticating with azure","type":"string"},"clientsecret":{"description":"The client secret to use authenticating with azure","type":"string"},"subscriptionid":{"type":"string","description":"The azure subscription id to be queried"},"tenantid":{"type":"string","description":"The azure tenant id to use"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in Azure"}}},"crowdstrike":{"type":"object","description":"Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.","required":["clientid","clientsecret","cloud"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to authenticate to the Falcon cloud api","type":"string"},"clientsecret":{"description":"The client secret to authenticate to the Falcon cloud api","type":"string"},"cloud":{"type":"string","description":"The Falcon cloud abbreviation to query","enum":["us-1","us-2","eu-1","us-gov-1"]},"filter":{"type":"string","description":"An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d"},"sort":{"type":"string","description":"An optional FQL sort string, e.g. last_seen_timestamp.desc"}}},"crowdstrikediscover":{"type":"object","description":"Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.","required":["clientid","clientsecret","cloud"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to authenticate to the Falcon cloud api","type":"string"},"clientsecret":{"description":"The client secret to authenticate to the Falcon cloud api","type":"string"},"cloud":{"type":"string","description":"The Falcon cloud abbreviation to query","enum":["us-1","us-2","eu-1","us-gov-1"]},"filter":{"type":"string","description":"An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d"},"sort":{"type":"string","description":"An optional FQL sort string, e.g. last_seen_timestamp.desc"}}},"ibm":{"type":"object","description":"Configuration options specific to ibm. nil if not configuring IBM Cloud","required":["apikey","region"],"properties":{"apikey":{"description":"The api key to use for authentication","type":"string"},"region":{"type":"string","description":"The IBM region to query"}}},"oracle":{"type":"object","description":"Configuration options specific to oracle. nil if not configuring Oracle Cloud","required":["user","tenancy","region"],"additionalProperties":false,"properties":{"user":{"description":"The user ocid to use for authentication to oracle cloud","type":"string"},"tenancy":{"description":"The tenancy ocid to use for connecting to oracle cloud","type":"string"},"region":{"type":"string","description":"The region of oracle cloud to connect to"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in oracle cloud"}}},"gcp":{"type":"object","description":"Configuration options specific to gcp. nil if not configuring GCP","required":["zone","credentials"],"additionalProperties":false,"properties":{"zone":{"description":"The GCP zone for this configuration","type":"string"},"credentials":{"type":"object","description":"The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.","additionalProperties":false,"required":["type","project_id","private_key_id","private_key","client_email","client_id","auth_uri","token_uri","auth_provider_x509_cert_url","client_x509_cert_url"],"properties":{"type":{"type":"string","description":"Credential type. this will typically be \"service_account\""},"project_id":{"type":"string","description":"The project id of the account"},"private_key_id":{"type":"string","description":"The private key id of the service account"},"private_key":{"type":"string","description":"The pirvate key to authenticate with"},"client_email":{"type":"string","description":"The email of the service account"},"client_id":{"type":"string","description":"The id of the client"},"auth_uri":{"type":"string","description":"OAth2 uri"},"token_uri":{"type":"string","description":"Token URI"},"auth_provider_x509_cert_url":{"type":"string","description":"Auth cert url"},"client_x509_cert_url":{"type":"string","description":"Client cert url"}}},"labels":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom label names to track in GCP"}}},"s3":{"type":"object","description":"Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n","required":["awsauthtype","region","bucket"],"additionalProperties":false,"properties":{"region":{"type":"string","description":"The aws region to authenticate to"},"bucket":{"type":"string","description":"The name of the s3 bucket from which to pull the csv file."},"path":{"type":"string","description":"The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..."},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}}}},"sentinelone":{"type":"object","description":"Configuration options specific to sentinelone. nil if not configuring SentinelOne","required":["base_url","params","token"],"additionalProperties":false,"properties":{"base_url":{"description":"The SentinelOne domain URL to query, e.g. https://.sentinelone.net ","type":"string"},"params":{"type":"object","additionalProperties":false,"properties":{"accountId":{"type":"string","description":"The SentinelOne account ID to query"},"filterId":{"type":"string","description":"The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000"}}},"token":{"description":"API token to use for authentication","type":"string"},"ranger":{"type":"object","properties":{"enabled":{"type":"boolean"}}}}},"wiz":{"type":"object","description":"Configuration options specific to wiz. nil if not configuring Wiz","required":["apiendpoint","tokenurl","clientid","clientsecret"],"additionalProperties":false,"properties":{"apiendpoint":{"description":"Wiz API Endpoint URL","type":"string","enum":["https://api.us1.app.wiz.io/graphql","https://api.us2.app.wiz.io/graphql","https://api.eu1.app.wiz.io/graphql","https://api.eu2.app.wiz.io/graphql","https://api.us17.app.wiz.io/graphql"]},"tokenurl":{"description":"Wiz Token URL","type":"string","enum":["https://auth.app.wiz.io/oauth/token","https://auth.wiz.io/oauth/token","https://auth.gov.wiz.io/oauth/token","https://auth0.gov.wiz.io/oauth/token"]},"clientid":{"description":"Client id to use authenticating with Wiz API","type":"string"},"clientsecret":{"description":"Client secret to use authenticating with Wiz API","type":"string"}}}}}]}}}}
```
## The integrations\_response\_bgp object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_bgp":{"type":"object","required":["expiration","community","factors","max","neighbors","nexthop"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"community":{"type":"string"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"nexthop":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}}}}}
```
## The integrations\_response\_blocklist object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_blocklist":{"type":"object","required":["factors","expiration","max"],"additionalProperties":false,"properties":{"factors":{"type":"array","items":{"type":"string"}},"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"max":{"type":"integer"},"whitelist":{"type":"array","items":{"type":"string"}}}}}}}
```
## The integrations\_response\_crowdstrike object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_crowdstrike":{"type":"object","required":["expiration","factors","max","url","client_id","client_secret"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"url":{"description":"Crowdstrike base API URL, can be found in your crowdstrike account","type":"string"},"client_id":{"type":"string"},"client_secret":{"type":"string"}}}}}}
```
## The integrations\_response\_email object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_email":{"type":"object","required":["recipients","cc","bcc"],"additionalProperties":false,"properties":{"recipients":{"type":"array","items":{"type":"string"}},"cc":{"type":"array","items":{"type":"string"}},"bcc":{"type":"array","items":{"type":"string"}}}}}}}
```
## The integrations\_response\_flowspec object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_flowspec":{"type":"object","required":["expiration","factors","max","neighbors"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"whitelist":{"type":"array","items":{"type":"string"}}}}}}}
```
## The integrations\_response\_flowspec\_custom object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_flowspec_custom":{"type":"object","required":["expiration","factors","max","neighbors","rule"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"rule":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}}}}}
```
## The integrations\_response\_ns1 object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_ns1":{"type":"object","required":["apikey","domain","link","type","zone"],"additionalProperties":false,"properties":{"apikey":{"description":"API Key","type":"string"},"domain":{"type":"string"},"link":{"type":"string"},"type":{"type":"string","description":"Record type"},"zone":{"type":"string"}}}}}}
```
## The integrations\_response\_pagerduty object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_pagerduty":{"type":"object","required":["apikey","integrationkey","severity"],"additionalProperties":false,"properties":{"apikey":{"type":"string"},"integrationkey":{"type":"string"},"severity":{"type":"string"}}}}}}
```
## The integrations\_response\_route53 object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_route53":{"type":"object","required":["accesskeyid","aliastarget","evaluatetargethealth","hostedzoneid","name","secretaccesskey","type"],"additionalProperties":false,"properties":{"accesskeyid":{"type":"string"},"aliastarget":{"type":"object"},"evaluatetargethealth":{"type":"boolean"},"hostedzoneid":{"type":"string"},"name":{"type":"string"},"secretaccesskey":{"type":"string"},"type":{"type":"string","description":"Record type"}}}}}}
```
## The integrations\_response\_rtbh object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_rtbh":{"type":"object","required":["expiration","community","factors","max","neighbors","nexthop"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"community":{"type":"string"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"nexthop":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}}}}}
```
## The integrations\_response\_slack object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_slack":{"type":"object","required":["url","channel"],"additionalProperties":false,"properties":{"url":{"type":"string"},"channel":{"type":"string"}}}}}}
```
## The integrations\_response\_syslog object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_syslog":{"type":"object","required":["host","facility","protocol","tag","output"],"additionalProperties":false,"properties":{"host":{"type":"string","description":"combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port."},"facility":{"type":"string","description":"LOG_LOCAL0 is a safe default","enum":["LOG_KERN","LOG_USER","LOG_MAIL","LOG_DAEMON","LOG_AUTH","LOG_SYSLOG","LOG_LPR","LOG_NEWS","LOG_UUCP","LOG_CRON","LOG_AUTHPRIV","LOG_FTP","LOG_LOCAL0","LOG_LOCAL1","LOG_LOCAL2","LOG_LOCAL3","LOG_LOCAL4","LOG_LOCAL5","LOG_LOCAL6","LOG_LOCAL7"]},"protocol":{"type":"string","description":"udp or tcp, udp is a safe default","enum":["udp","tcp"]},"tag":{"type":"string","description":"dot separated “application tag” that will be included in messages"},"output":{"type":"string","description":"One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)","enum":["CEE","CEF","DEFAULT"]}}}}}}
```
## The integrations\_response\_teams object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_teams":{"type":"object","required":["url"],"additionalProperties":false,"properties":{"url":{"type":"string"},"short":{"type":"boolean","description":"Display messages in a shorter style"}}}}}}
```
## The integrations\_response\_twilio object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_twilio":{"type":"object","required":["accountsid","authtoken","to","messagingservicesid"],"additionalProperties":false,"properties":{"accountsid":{"type":"string"},"authtoken":{"type":"string"},"to":{"type":"object","additionalProperties":false,"properties":{"number":{"type":"string"},"region":{"type":"string"}}},"messagingservicesid":{"type":"string"}}}}}}
```
## The integrations\_response\_webhook object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response_webhook":{"type":"object","required":["url"],"additionalProperties":false,"properties":{"authpassword":{"type":"string","description":"HTTP Basic Auth password"},"authusername":{"type":"string","description":"HTTP Basic Auth ID"},"contenttype":{"type":"string"},"headers":{"type":"object","description":"Comma separated list of header:value pairs"},"skipsslverification":{"type":"boolean","description":"Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate"},"url":{"type":"string"}}}}}}
```
## The integrations\_response object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"integrations_response":{"description":"List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.","type":"object","required":["adapter","name","description"],"allOf":[{"type":"object","additionalProperties":false,"properties":{"adapter":{"type":"string","description":"The type of response integration. The config object is dependant on this.","enum":["bgp","blocklist","crowdstrike","email","flowspec","flowspec_custom","ns1","pagerduty","route53","rtbh","slack","syslog","teams","twilio","webhook"]},"name":{"type":"string","description":"The name of the response integration"},"description":{"type":"string","description":"The description of the response integration."},"config":{"oneOf":[{"type":"object","required":["expiration","community","factors","max","neighbors","nexthop"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"community":{"type":"string"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"nexthop":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["factors","expiration","max"],"additionalProperties":false,"properties":{"factors":{"type":"array","items":{"type":"string"}},"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"max":{"type":"integer"},"whitelist":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["expiration","factors","max","url","client_id","client_secret"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"url":{"description":"Crowdstrike base API URL, can be found in your crowdstrike account","type":"string"},"client_id":{"type":"string"},"client_secret":{"type":"string"}}},{"type":"object","required":["recipients","cc","bcc"],"additionalProperties":false,"properties":{"recipients":{"type":"array","items":{"type":"string"}},"cc":{"type":"array","items":{"type":"string"}},"bcc":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["expiration","factors","max","neighbors"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"whitelist":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["expiration","factors","max","neighbors","rule"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"rule":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["apikey","domain","link","type","zone"],"additionalProperties":false,"properties":{"apikey":{"description":"API Key","type":"string"},"domain":{"type":"string"},"link":{"type":"string"},"type":{"type":"string","description":"Record type"},"zone":{"type":"string"}}},{"type":"object","required":["apikey","integrationkey","severity"],"additionalProperties":false,"properties":{"apikey":{"type":"string"},"integrationkey":{"type":"string"},"severity":{"type":"string"}}},{"type":"object","required":["accesskeyid","aliastarget","evaluatetargethealth","hostedzoneid","name","secretaccesskey","type"],"additionalProperties":false,"properties":{"accesskeyid":{"type":"string"},"aliastarget":{"type":"object"},"evaluatetargethealth":{"type":"boolean"},"hostedzoneid":{"type":"string"},"name":{"type":"string"},"secretaccesskey":{"type":"string"},"type":{"type":"string","description":"Record type"}}},{"type":"object","required":["expiration","community","factors","max","neighbors","nexthop"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"community":{"type":"string"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"nexthop":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["url","channel"],"additionalProperties":false,"properties":{"url":{"type":"string"},"channel":{"type":"string"}}},{"type":"object","required":["host","facility","protocol","tag","output"],"additionalProperties":false,"properties":{"host":{"type":"string","description":"combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port."},"facility":{"type":"string","description":"LOG_LOCAL0 is a safe default","enum":["LOG_KERN","LOG_USER","LOG_MAIL","LOG_DAEMON","LOG_AUTH","LOG_SYSLOG","LOG_LPR","LOG_NEWS","LOG_UUCP","LOG_CRON","LOG_AUTHPRIV","LOG_FTP","LOG_LOCAL0","LOG_LOCAL1","LOG_LOCAL2","LOG_LOCAL3","LOG_LOCAL4","LOG_LOCAL5","LOG_LOCAL6","LOG_LOCAL7"]},"protocol":{"type":"string","description":"udp or tcp, udp is a safe default","enum":["udp","tcp"]},"tag":{"type":"string","description":"dot separated “application tag” that will be included in messages"},"output":{"type":"string","description":"One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)","enum":["CEE","CEF","DEFAULT"]}}},{"type":"object","required":["url"],"additionalProperties":false,"properties":{"url":{"type":"string"},"short":{"type":"boolean","description":"Display messages in a shorter style"}}},{"type":"object","required":["accountsid","authtoken","to","messagingservicesid"],"additionalProperties":false,"properties":{"accountsid":{"type":"string"},"authtoken":{"type":"string"},"to":{"type":"object","additionalProperties":false,"properties":{"number":{"type":"string"},"region":{"type":"string"}}},"messagingservicesid":{"type":"string"}}},{"type":"object","required":["url"],"additionalProperties":false,"properties":{"authpassword":{"type":"string","description":"HTTP Basic Auth password"},"authusername":{"type":"string","description":"HTTP Basic Auth ID"},"contenttype":{"type":"string"},"headers":{"type":"object","description":"Comma separated list of header:value pairs"},"skipsslverification":{"type":"boolean","description":"Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate"},"url":{"type":"string"}}}]}}}]}}}}
```
## The flow\_tag\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"flow_tag_config":{"required":["name","tags"],"additionalProperties":false,"properties":{"name":{"description":"The name of the Flow Tag Rule. Eg. carrier tags","type":"string"},"tags":{"description":"An array of strings to tag every flow that matches this response policy (rule) with","type":"array","items":{"type":"string"}},"inputaliasregex":{"description":"A regular expression that matches against inputalias of a given flow record.","type":"string"},"inputnameregex":{"description":"A regular expression that matches against inputname of the input interface of a given flow record.","type":"string"},"outputaliasregex":{"description":"A regular expression that matches against outputalias of a given flow record.","type":"string"},"outputnameregex":{"description":"A regular expression that matches against outputname of a given flow record.","type":"string"},"srcnets":{"description":"An array of CIDR blocks to match against the source IP for a given flow record.","type":"array","items":{"type":"string"}},"dstnets":{"description":"An array of CIDR blocks to match against the destination IP for a given flow record.","type":"array","items":{"type":"string"}},"srcport":{"description":"Source port to match against a given flow.","type":"integer","format":"int32"},"dstport":{"description":"Destination port to match against a given flow.","type":"integer","format":"int32"},"protocol":{"description":"lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc","type":"string"},"tcpflagsint":{"description":"integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.","type":"integer","format":"int32"},"srcas":{"description":"An array of AS numbers to match against the source AS for a given flow record.","type":"array","items":{"type":"integer"}},"dstas":{"description":"An array of AS numbers to match against the destination AS for a given flow record.","type":"array","items":{"type":"integer"}},"srcowneras":{"description":"An array of AS numbers to match against the AS of the source IP for a given flow record.","type":"array","items":{"type":"integer"}},"dstowneras":{"description":"An array of AS numbers to match against the AS of the destination IP for a given flow record.","type":"array","items":{"type":"integer"}}}}}}}
```
## The permission\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"permission_record":{"type":"object","required":["resource"],"additionalProperties":false,"properties":{"resource":{"type":"string","description":"Resource Name"},"description":{"type":"string","description":"Resource description and/or mapping to portal"},"fetch":{"type":"boolean","description":"If fetch/get is an available action"},"create":{"type":"boolean","description":"If create is an available action"},"update":{"type":"boolean","description":"If update is an available action"},"delete":{"type":"boolean","description":"If delete is an available action"}}}}}}
```
## The role\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"role_config":{"required":["name","permissions"],"additionalProperties":false,"properties":{"name":{"description":"The name of the role.","type":"string"},"description":{"description":"A user friendly description of the role.","type":"string"},"canMasquerade":{"description":"(resellers only) Whether or not the role can masquerade into sub accounts.","type":"boolean","default":false},"canSendFlow":{"description":"Whether or not the role can send NetoFlow.","type":"boolean","default":false},"permissions":{"type":"array","items":{"allOf":[{"type":"object","required":["resource"],"additionalProperties":false,"properties":{"resource":{"type":"string","description":"Resource Name"},"description":{"type":"string","description":"Resource description and/or mapping to portal"},"fetch":{"type":"boolean","description":"If fetch/get is an available action"},"create":{"type":"boolean","description":"If create is an available action"},"update":{"type":"boolean","description":"If update is an available action"},"delete":{"type":"boolean","description":"If delete is an available action"}}}]}}}}}}}
```
## The user\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"user_config":{"required":["given_name","family_name","email","roles"],"additionalProperties":false,"properties":{"given_name":{"description":"First or Given name of the user","type":"string"},"family_name":{"description":"Last or Family name of the user","type":"string"},"email":{"description":"User's email. This is the main identifier and cannot be changed.","type":"string"},"nickname":{"description":"User's nickname. Optional"},"picture":{"description":"HTTPS URL to a user's profile picture. Optional"},"roles":{"type":"array","items":{"type":"string"},"description":"An array containing strings which include the role name the user should be assigned to."}}}}}}
```
## The api\_key\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"api_key_record":{"description":"API Key Record","type":"object","properties":{"appname":{"type":"string","readOnly":true,"description":"API Key Name"},"description":{"type":"string","description":"API Key Description"},"roles":{"type":"array","maxItems":1,"items":{"type":"string"},"description":"An array containing strings which include the role name the user should be assigned to."},"last_login":{"type":"number","readOnly":true,"description":"Unix timestamp of last login"},"last_ip":{"type":"string","readOnly":true,"description":"Last IP address used to login"}}}}}}
```
## The api\_key\_config\_create object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"api_key_config_create":{"description":"API Key Create Config","type":"object","required":["appname","roles"],"properties":{"appname":{"description":"API Key Name","type":"string"},"description":{"description":"API Key Description","type":"string"},"roles":{"description":"An array containing strings which include the role name the user should be assigned to.","type":"array","items":{"type":"string"}}}}}}}
```
## The api\_key\_config\_update object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"api_key_config_update":{"description":"API Key Update Config","type":"object","properties":{"description":{"description":"API Key Description","type":"string"},"roles":{"description":"An array containing strings which include the role name the user should be assigned to.","type":"array","items":{"type":"string"}}}}}}}
```
## The account\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"account_record":{"type":"object","description":"Account properties","additionalProperties":false,"properties":{"id":{"type":"string","readOnly":true,"description":"Internal ID. Immutable"},"billing":{"type":"object","description":"Configuration Information","additionalProperties":false,"properties":{"data_retention":{"type":"integer","description":"Data Retention (days)"},"rollup_retention":{"type":"integer","description":"Data Rollup Retention (days)"},"trial":{"type":"boolean","description":"True if considered a trial account"}}},"ingest_ip":{"type":"string","description":"Flow ingest ip address assigned to the customer"},"ingest_port":{"type":"integer","description":"Flow ingest ip port assigned to the customer"},"reseller":{"type":"object","description":"Reseller Configuration","additionalProperties":false,"properties":{"children":{"type":"integer","description":"Number of direct sub accounts"},"is_parent":{"type":"boolean","description":"True if sub accounts exist"},"node":{"type":"string","description":"Tree-based shortname for reseller heirarchy"},"parent":{"type":"string","description":"Shortname of the parent reseller"}}},"shortname":{"type":"string","description":"Account shortname"}}}}}}
```
## The traffic\_detection\_model\_common object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"traffic_detection_model_common":{"type":"object","properties":{"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the detection model","type":"array","items":{"type":"string"}},"description":{"description":"Detection model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the detection model is enabled","type":"boolean"},"factors":{"description":"Factors for the detection model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the detection model","type":"string"},"rollupperiod":{"description":"The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the detection model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the detection model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the detection model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the detection model","type":"string","enum":["flow","dns"]}}}}}}
```
## The traffic\_detection\_model\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"traffic_detection_model_record":{"description":"Traffic Detection Model Record","type":"object","allOf":[{"type":"object","properties":{"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the detection model","type":"array","items":{"type":"string"}},"description":{"description":"Detection model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the detection model is enabled","type":"boolean"},"factors":{"description":"Factors for the detection model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the detection model","type":"string"},"rollupperiod":{"description":"The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the detection model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the detection model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the detection model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the detection model","type":"string","enum":["flow","dns"]}}}],"properties":{"algo_type":{"description":"Detection model type","type":"string"},"beta":{"description":"If true, it's a beta detection model","type":"boolean"},"created":{"description":"The time at which record was created","type":"integer"},"id":{"description":"Detection model ID","type":"string"},"recommended":{"description":"If true, it's a recomended detection model","type":"boolean"},"subscription":{"description":"Subscription for the detection model","type":"object","properties":{"all":{"type":"string"}}},"subscriptiontype":{"description":"Subscription type for the detection model","type":"string"},"system":{"description":"If true, it's a system detection model","type":"boolean"},"systemdefault":{"description":"If true, it's a system default detection model","type":"boolean"},"updated":{"description":"The time at which record was was last updated","type":"integer"}}}}}}
```
## The traffic\_detection\_model\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"traffic_detection_model_config":{"description":"Traffic Detection Model Create or Update Config","type":"object","required":["categories","description","name","rollupperiod","search_by","thresholds","track_by","algo_record_type"],"allOf":[{"type":"object","properties":{"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the detection model","type":"array","items":{"type":"string"}},"description":{"description":"Detection model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the detection model is enabled","type":"boolean"},"factors":{"description":"Factors for the detection model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the detection model","type":"string"},"rollupperiod":{"description":"The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the detection model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the detection model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the detection model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the detection model","type":"string","enum":["flow","dns"]}}}]}}}}
```
## The context\_creation\_model\_common object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"context_creation_model_common":{"type":"object","properties":{"action":{"description":"Action for the context model","type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"field":{"type":"string"},"context":{"type":"string"},"labels":{"type":"array","items":{"type":"string"}}}}},"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the context model","type":"array","items":{"type":"string"}},"description":{"description":"Context model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the context model is enabled","type":"boolean"},"expiration":{"description":"Number of seconds the context creation model will remain active","type":"integer"},"factors":{"description":"Factors for the context model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the context model","type":"string"},"rollupperiod":{"description":"The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the context model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the context model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the context model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the context model","type":"string","enum":["flow","dns"]}}}}}}
```
## The context\_creation\_model\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"context_creation_model_record":{"description":"Context Creation Model Record","type":"object","allOf":[{"type":"object","properties":{"action":{"description":"Action for the context model","type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"field":{"type":"string"},"context":{"type":"string"},"labels":{"type":"array","items":{"type":"string"}}}}},"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the context model","type":"array","items":{"type":"string"}},"description":{"description":"Context model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the context model is enabled","type":"boolean"},"expiration":{"description":"Number of seconds the context creation model will remain active","type":"integer"},"factors":{"description":"Factors for the context model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the context model","type":"string"},"rollupperiod":{"description":"The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the context model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the context model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the context model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the context model","type":"string","enum":["flow","dns"]}}}],"properties":{"algo_type":{"description":"Context model type","type":"string"},"beta":{"description":"If true, it's a beta context model","type":"boolean"},"created":{"description":"The time at which record was created","type":"integer"},"id":{"description":"Context model ID","type":"string"},"recommended":{"description":"If true, it's a recomended context model","type":"boolean"},"subscription":{"description":"Subscription for the context model","type":"object","properties":{"all":{"type":"string"}}},"subscriptiontype":{"description":"Subscription type for the context model","type":"string"},"system":{"description":"If true, it's a system context model","type":"boolean"},"systemdefault":{"description":"If true, it's a system default context model","type":"boolean"},"updated":{"description":"The time at which record was was last updated","type":"integer"}}}}}}
```
## The context\_creation\_model\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"context_creation_model_config":{"description":"Context Creation Model Create or Update Config","type":"object","required":["description","expiration","name","rollupperiod","search_by","thresholds","track_by","algo_record_type"],"allOf":[{"type":"object","properties":{"action":{"description":"Action for the context model","type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"field":{"type":"string"},"context":{"type":"string"},"labels":{"type":"array","items":{"type":"string"}}}}},"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the context model","type":"array","items":{"type":"string"}},"description":{"description":"Context model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the context model is enabled","type":"boolean"},"expiration":{"description":"Number of seconds the context creation model will remain active","type":"integer"},"factors":{"description":"Factors for the context model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the context model","type":"string"},"rollupperiod":{"description":"The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the context model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the context model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the context model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the context model","type":"string","enum":["flow","dns"]}}}]}}}}
```
## The detection\_category\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"detection_category_record":{"description":"Detection Category Record","type":"object","properties":{"description":{"description":"Detection category description","type":"string"},"name":{"description":"Detection category name","type":"string"},"system":{"description":"If true, it's a system detection category","type":"boolean"},"systemdefault":{"description":"If true, it's a system default detection category","type":"boolean"}}}}}}
```
## The detection\_category\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"detection_category_config":{"description":"Detection Category Create or Update Config","type":"object","properties":{"description":{"description":"Detection category description","type":"string"}}}}}}
```
## The response\_policy\_common object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"response_policy_common":{"type":"object","properties":{"config":{"type":"object","properties":{"alerttypes":{"type":"array","items":{"type":"string","enum":["all","start","ongoing","end"]}},"severities":{"type":"array","items":{"type":"string","enum":["all","low","medium","high"]}},"algorithms":{"type":"array","items":{"type":"string","description":"Detection Model (algorithm) name"}},"categories":{"type":"array","items":{"type":"string","description":"Detection Category name"}},"tracks":{"type":"array","items":{"type":"string","enum":["all","dstip","flowsrcname","input","output","srcip"]}}}},"description":{"type":"string"},"name":{"type":"string"},"enabled":{"type":"boolean"},"type":{"type":"string","enum":["alert"]}}}}}}
```
## The response\_policy\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"response_policy_record":{"description":"Response Policy Record","type":"object","allOf":[{"type":"object","properties":{"config":{"type":"object","properties":{"alerttypes":{"type":"array","items":{"type":"string","enum":["all","start","ongoing","end"]}},"severities":{"type":"array","items":{"type":"string","enum":["all","low","medium","high"]}},"algorithms":{"type":"array","items":{"type":"string","description":"Detection Model (algorithm) name"}},"categories":{"type":"array","items":{"type":"string","description":"Detection Category name"}},"tracks":{"type":"array","items":{"type":"string","enum":["all","dstip","flowsrcname","input","output","srcip"]}}}},"description":{"type":"string"},"name":{"type":"string"},"enabled":{"type":"boolean"},"type":{"type":"string","enum":["alert"]}}}],"properties":{"id":{"type":"string","description":"Response Policy ID"},"plugins":{"type":"array","items":{"type":"object","properties":{"adapter":{"type":"string","description":"Plugin type to be used in the response policy"},"description":{"type":"string","description":"Plugin description to be used in the response policy"},"id":{"type":"string","description":"Plugin ID to be used in the response policy"},"name":{"type":"string","description":"Plugin name to be used in the response policy"},"type":{"type":"string","enum":["block","dns","notification","traffic"],"description":"Plugin type to be used in the response policy"}}}}}}}}}
```
## The response\_policy\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"response_policy_config":{"description":"Response Policy Create or Update Config","type":"object","required":["name"],"allOf":[{"type":"object","properties":{"config":{"type":"object","properties":{"alerttypes":{"type":"array","items":{"type":"string","enum":["all","start","ongoing","end"]}},"severities":{"type":"array","items":{"type":"string","enum":["all","low","medium","high"]}},"algorithms":{"type":"array","items":{"type":"string","description":"Detection Model (algorithm) name"}},"categories":{"type":"array","items":{"type":"string","description":"Detection Category name"}},"tracks":{"type":"array","items":{"type":"string","enum":["all","dstip","flowsrcname","input","output","srcip"]}}}},"description":{"type":"string"},"name":{"type":"string"},"enabled":{"type":"boolean"},"type":{"type":"string","enum":["alert"]}}}],"properties":{"plugins":{"type":"array","items":{"type":"string","description":"Plugin ID to be used in the response policy"}}}}}}}
```
## The threshold\_override\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"threshold_override_record":{"description":"Threshold Override Record","type":"object","properties":{"algorithm":{"type":"string"},"auto":{"type":"boolean"},"beta":{"type":"boolean"},"bypassdisplay":{"type":"boolean"},"bypassrule":{"type":"boolean"},"createdby":{"type":"string"},"default":{"type":"boolean"},"discards":{"type":"array"},"items":{"type":"string"},"ndm_score_confidence":{"type":"integer"},"ndm_score_threat":{"type":"integer"},"rollupperiod":{"type":"integer"},"sharedkey":{"type":"boolean"},"state":{"type":"string"},"thresholds":{"type":"array","items":{"type":"object","properties":{"severity":{"type":"string","enum":["low","medium","high"]},"threshold":{"type":"string"}}}},"track":{"type":"string"},"updateinterval":{"type":"integer"}}}}}}
```
## The threshold\_override\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"threshold_override_config":{"description":"Threshold Override Create or Update Config","type":"object","required":["algorithm","rollupperiod","thresholds","track","updateinterval"],"allOf":[{"description":"Threshold Override Record","type":"object","properties":{"algorithm":{"type":"string"},"auto":{"type":"boolean"},"beta":{"type":"boolean"},"bypassdisplay":{"type":"boolean"},"bypassrule":{"type":"boolean"},"createdby":{"type":"string"},"default":{"type":"boolean"},"discards":{"type":"array"},"items":{"type":"string"},"ndm_score_confidence":{"type":"integer"},"ndm_score_threat":{"type":"integer"},"rollupperiod":{"type":"integer"},"sharedkey":{"type":"boolean"},"state":{"type":"string"},"thresholds":{"type":"array","items":{"type":"object","properties":{"severity":{"type":"string","enum":["low","medium","high"]},"threshold":{"type":"string"}}}},"track":{"type":"string"},"updateinterval":{"type":"integer"}}}]}}}}
```
## The bgp\_neighbor\_common object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"bgp_neighbor_common":{"type":"object","properties":{"addresslocal":{"type":"string"},"addressremote":{"type":"string"},"admindown":{"type":"boolean"},"advanced":{"type":"boolean"},"asn":{"type":"string"},"authpassword":{"type":"string"},"description":{"type":"string"},"deviceid":{"type":"string"},"gracefulrestart":{"type":"boolean"},"holdtime":{"type":"integer"},"ipv4-flowspec":{"type":"boolean"},"ipv4-unicast":{"type":"boolean"},"ipv6-flowspec":{"type":"boolean"},"ipv6-unicast":{"type":"boolean"},"keepalive":{"type":"integer"},"negotiated":{"type":"object","properties":{"capabilities":{"type":"array"},"holdtime":{"type":"integer"},"keepalive":{"type":"integer"}}},"restarttime":{"type":"integer"},"routes":{"type":"object","properties":{"ipv4-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv4-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"total":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"prefixrate":{"type":"integer"},"prefixsessioncount":{"type":"integer"},"prefixtotalcount":{"type":"integer"},"received":{"type":"integer"}}}}},"state":{"type":"string"},"stats":{"type":"object","properties":{"recv":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}},"sent":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}}}},"uptime":{"type":"string"}}}}}}
```
## The bgp\_neighbor\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"bgp_neighbor_record":{"description":"BGP Neighbor Record","type":"object","allOf":[{"type":"object","properties":{"addresslocal":{"type":"string"},"addressremote":{"type":"string"},"admindown":{"type":"boolean"},"advanced":{"type":"boolean"},"asn":{"type":"string"},"authpassword":{"type":"string"},"description":{"type":"string"},"deviceid":{"type":"string"},"gracefulrestart":{"type":"boolean"},"holdtime":{"type":"integer"},"ipv4-flowspec":{"type":"boolean"},"ipv4-unicast":{"type":"boolean"},"ipv6-flowspec":{"type":"boolean"},"ipv6-unicast":{"type":"boolean"},"keepalive":{"type":"integer"},"negotiated":{"type":"object","properties":{"capabilities":{"type":"array"},"holdtime":{"type":"integer"},"keepalive":{"type":"integer"}}},"restarttime":{"type":"integer"},"routes":{"type":"object","properties":{"ipv4-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv4-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"total":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"prefixrate":{"type":"integer"},"prefixsessioncount":{"type":"integer"},"prefixtotalcount":{"type":"integer"},"received":{"type":"integer"}}}}},"state":{"type":"string"},"stats":{"type":"object","properties":{"recv":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}},"sent":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}}}},"uptime":{"type":"string"}}}],"properties":{"id":{"type":"string"}}}}}}
```
## The bgp\_neighbor\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"bgp_neighbor_config":{"description":"BGP Neighbor Create or Update Config","type":"object","allOf":[{"type":"object","properties":{"addresslocal":{"type":"string"},"addressremote":{"type":"string"},"admindown":{"type":"boolean"},"advanced":{"type":"boolean"},"asn":{"type":"string"},"authpassword":{"type":"string"},"description":{"type":"string"},"deviceid":{"type":"string"},"gracefulrestart":{"type":"boolean"},"holdtime":{"type":"integer"},"ipv4-flowspec":{"type":"boolean"},"ipv4-unicast":{"type":"boolean"},"ipv6-flowspec":{"type":"boolean"},"ipv6-unicast":{"type":"boolean"},"keepalive":{"type":"integer"},"negotiated":{"type":"object","properties":{"capabilities":{"type":"array"},"holdtime":{"type":"integer"},"keepalive":{"type":"integer"}}},"restarttime":{"type":"integer"},"routes":{"type":"object","properties":{"ipv4-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv4-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"total":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"prefixrate":{"type":"integer"},"prefixsessioncount":{"type":"integer"},"prefixtotalcount":{"type":"integer"},"received":{"type":"integer"}}}}},"state":{"type":"string"},"stats":{"type":"object","properties":{"recv":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}},"sent":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}}}},"uptime":{"type":"string"}}}],"required":["addressremote","description","asn"]}}}}
```
## The netclass\_common object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"netclass_common":{"type":"object","properties":{"networks":{"type":"array","items":{"type":"string"},"description":"The list of networks in the classification."},"privatenets":{"type":"boolean","description":"Whether the classification includes private networks."},"privateasns":{"type":"boolean","description":"Whether the classification includes private ASNs."},"asns":{"type":"array","items":{"type":"string"},"description":"The list of ASNs in the classification."}}}}}}
```
## The netclass\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"netclass_record":{"description":"Network Classification Record","type":"object","allOf":[{"type":"object","properties":{"networks":{"type":"array","items":{"type":"string"},"description":"The list of networks in the classification."},"privatenets":{"type":"boolean","description":"Whether the classification includes private networks."},"privateasns":{"type":"boolean","description":"Whether the classification includes private ASNs."},"asns":{"type":"array","items":{"type":"string"},"description":"The list of ASNs in the classification."}}}],"properties":{"id":{"type":"string","description":"The unique identifier for the network classification."},"type":{"type":"string","description":"The type of network classification."}}}}}}
```
## The netclass\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"netclass_config":{"description":"Network Classification Create or Update Config","type":"object","allOf":[{"type":"object","properties":{"networks":{"type":"array","items":{"type":"string"},"description":"The list of networks in the classification."},"privatenets":{"type":"boolean","description":"Whether the classification includes private networks."},"privateasns":{"type":"boolean","description":"Whether the classification includes private ASNs."},"asns":{"type":"array","items":{"type":"string"},"description":"The list of ASNs in the classification."}}}],"required":["networks","privatenets"]}}}}
```
## The dnsclass\_common object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"dnsclass_common":{"type":"object","properties":{"domains":{"type":"array","items":{"type":"string"},"description":"The list of internal domains"}}}}}}
```
## The dnsclass\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"dnsclass_record":{"description":"DNS Classification Record","type":"object","allOf":[{"type":"object","properties":{"domains":{"type":"array","items":{"type":"string"},"description":"The list of internal domains"}}}],"properties":{"id":{"type":"string","description":"The unique identifier for the dns classification."}}}}}}
```
## The dnsclass\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"dnsclass_config":{"description":"DNS Classification Create or Update Config","type":"object","allOf":[{"type":"object","properties":{"domains":{"type":"array","items":{"type":"string"},"description":"The list of internal domains"}}}],"required":["domains"]}}}}
```
## The threshold\_automaton\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"threshold_automaton_config":{"description":"Threshold Automaton Create or Update Config","type":"object","properties":{"algorithm":{"type":"string","description":"name of detection model"},"data_interval":{"type":"string","description":"defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to."},"data_lookback":{"type":"string","description":"determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides"},"data_window":{"type":"string","description":"defines the period of over which values are aggregated for Track By aggregates."},"disabled":{"type":"boolean","description":"disables auto-thresholding for the given automaton"},"filters":{"type":"array","items":{"type":"string"}},"force_override":{"type":"boolean","description":"optional, if set will override the default behavior preventing threshold values below the global average"},"high_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating high-severity thresholds"},"med_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating medium-severity thresholds"},"low_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating low-severity thresholds"},"strategy":{"type":"string","description":"used to determine the default threshold, either uses the maximum or average of data values."},"thresholds":{"type":"array","items":{"type":"string"}},"track_by":{"type":"array","description":"values to aggregate data on, should match parent DM track-by fields.","items":{"type":"string"}},"update_interval":{"type":"string"}}}}}}
```
## The threshold\_automaton\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"threshold_automaton_record":{"description":"Threshold Automaton Record","type":"object","allOf":[{"description":"Threshold Automaton Create or Update Config","type":"object","properties":{"algorithm":{"type":"string","description":"name of detection model"},"data_interval":{"type":"string","description":"defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to."},"data_lookback":{"type":"string","description":"determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides"},"data_window":{"type":"string","description":"defines the period of over which values are aggregated for Track By aggregates."},"disabled":{"type":"boolean","description":"disables auto-thresholding for the given automaton"},"filters":{"type":"array","items":{"type":"string"}},"force_override":{"type":"boolean","description":"optional, if set will override the default behavior preventing threshold values below the global average"},"high_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating high-severity thresholds"},"med_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating medium-severity thresholds"},"low_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating low-severity thresholds"},"strategy":{"type":"string","description":"used to determine the default threshold, either uses the maximum or average of data values."},"thresholds":{"type":"array","items":{"type":"string"}},"track_by":{"type":"array","description":"values to aggregate data on, should match parent DM track-by fields.","items":{"type":"string"}},"update_interval":{"type":"string"}}}],"properties":{"customer":{"type":"string","description":"customer shortname"}}}}}}
```
## The threshold\_automaton\_patch\_config object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"threshold_automaton_patch_config":{"description":"Threshold Automaton Record","type":"object","anyOf":[{"description":"Threshold Automaton Create or Update Config","type":"object","properties":{"algorithm":{"type":"string","description":"name of detection model"},"data_interval":{"type":"string","description":"defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to."},"data_lookback":{"type":"string","description":"determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides"},"data_window":{"type":"string","description":"defines the period of over which values are aggregated for Track By aggregates."},"disabled":{"type":"boolean","description":"disables auto-thresholding for the given automaton"},"filters":{"type":"array","items":{"type":"string"}},"force_override":{"type":"boolean","description":"optional, if set will override the default behavior preventing threshold values below the global average"},"high_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating high-severity thresholds"},"med_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating medium-severity thresholds"},"low_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating low-severity thresholds"},"strategy":{"type":"string","description":"used to determine the default threshold, either uses the maximum or average of data values."},"thresholds":{"type":"array","items":{"type":"string"}},"track_by":{"type":"array","description":"values to aggregate data on, should match parent DM track-by fields.","items":{"type":"string"}},"update_interval":{"type":"string"}}}]}}}}
```
## The threshold\_track\_value object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"threshold_track_value":{"description":"Threshold Automaton Create or Update Config","type":"object","properties":{"average":{"type":"number","description":"average value for operation"},"deviation":{"type":"number"},"operation":{"type":"string"},"threshold":{"type":"array","description":"array holding values for each configured severity level for the data point.","items":{"type":"object","properties":{"level":{"type":"string"},"value":{"type":"number"}}}},"customer":{"type":"string","description":"Netography customer shortname"},"group":{"type":"string","description":"the specific track (group) the data corresponds to."},"algorithm":{"type":"string","description":"the detection model the threshold values are derived from"},"timestamp":{"type":"number","description":"unix timestamp describing when the threshold values were generated"}}}}}}
```
## The mitre\_technique\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"mitre_technique_record":{"description":"MITRE ATT&CK Technique Record","type":"object","properties":{"technique_id":{"type":"string"},"technique_name":{"type":"string"},"sub_techniques":{"type":"array","items":{"type":"object","properties":{"technique_id":{"type":"string"},"technique_name":{"type":"string"}}}}}}}}}
```
## The mitre\_tactic\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"mitre_tactic_record":{"description":"MITRE ATT&CK Tactic Record","type":"object","properties":{"tactic_name":{"type":"string"},"tactic_id":{"type":"string"},"techniques":{"type":"array","items":{"description":"MITRE ATT&CK Technique Record","type":"object","properties":{"technique_id":{"type":"string"},"technique_name":{"type":"string"},"sub_techniques":{"type":"array","items":{"type":"object","properties":{"technique_id":{"type":"string"},"technique_name":{"type":"string"}}}}}}}}}}}}
```
## The dns\_device\_record object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"dns_device_record":{"type":"object","description":"Response schema for a single DNS device.","properties":{"id":{"type":"string","description":"Unique identifier for the DNS device."},"name":{"type":"string","description":"Name of the DNS device."},"type":{"type":"string","description":"Type of the DNS device."},"site":{"type":"string","description":"Site location of the DNS device."},"enabled":{"type":"boolean","description":"Whether the DNS device is enabled."}},"required":["id","name","type","site","enabled"]}}}}
```
## The AccountRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"AccountRecord":{"type":"object","description":"Account properties","additionalProperties":false,"properties":{"id":{"type":"string","readOnly":true,"description":"Internal ID. Immutable"},"billing":{"type":"object","description":"Configuration Information","additionalProperties":false,"properties":{"data_retention":{"type":"integer","description":"Data Retention (days)"},"rollup_retention":{"type":"integer","description":"Data Rollup Retention (days)"},"trial":{"type":"boolean","description":"True if considered a trial account"}}},"ingest_ip":{"type":"string","description":"Flow ingest ip address assigned to the customer"},"ingest_port":{"type":"integer","description":"Flow ingest ip port assigned to the customer"},"reseller":{"type":"object","description":"Reseller Configuration","additionalProperties":false,"properties":{"children":{"type":"integer","description":"Number of direct sub accounts"},"is_parent":{"type":"boolean","description":"True if sub accounts exist"},"node":{"type":"string","description":"Tree-based shortname for reseller heirarchy"},"parent":{"type":"string","description":"Shortname of the parent reseller"}}},"shortname":{"type":"string","description":"Account shortname"}}}}}}
```
## The AggregationSeries object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"AggregationSeries":{"type":"object","description":"Configuration for a data aggregation series used in analytics queries. Defines how to group, filter, and aggregate data with various options for fields, metrics, and time intervals.","required":["name","metric"],"additionalProperties":false,"properties":{"name":{"type":"string","description":"Series name. All series in a query must have a unique name. This is how you will locate them in the response."},"field":{"type":"array","items":{"type":"string"},"description":"Field name(s) to aggregate (split) on. See Analytics > Fields for more information.","maxItems":7},"field_separator":{"type":"string","default":".","description":"when multiple fields are provided in the request, the separator is used to join the two fields in the `label` and `name` keys in the response"},"interval":{"type":"integer","description":"Time interval to group the data. If not provided the interval will be calculated based on start/end times. The greater the window the larger the interval.","minimum":1,"maximum":2147483647,"format":"int32"},"ipagg":{"type":"object","description":"IP aggregation configuration for grouping IP addresses by CIDR blocks.","required":["cidr","field"],"additionalProperties":false,"properties":{"cidr":{"type":"integer","description":"CIDR to aggregate on. 8, 16, 32","minimum":8,"maximum":32,"format":"int32"},"field":{"type":"string","description":"Field to aggregate the CIDR on. For flow and block valid fields are `srcip` and `dstip`. For alert the valid field is `ipinfo.ip`"}}},"metric":{"type":"string","description":"metric to aggregate on. See Metrics for available values."},"search":{"type":"array","maxItems":1,"description":"A NQL search filter for constraining the dataset. Only one search is allowed for aggregation series.","items":{"type":"string","description":"NQL query string for filtering data."}},"size":{"type":"integer","minimum":1,"maximum":10000,"description":"The \"Top N\" number of series to limit this query to. Not required for cardinality."},"sort":{"type":"string","description":"Buckets returned ascending (asc) or descending (desc).","default":"asc","enum":["asc","desc"]}}}}}}
```
## The AlertRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"AlertRecord":{"description":"Event Record","type":"object","additionalProperties":false,"properties":{"alerttype":{"description":"Type of alert. Eg start, end, ongoing.","type":"string"},"algorithm":{"description":"Name of the Detection Model (algorithm) that triggered the alert.","type":"string"},"categories":{"description":"categories of the alert. Eg security, ddos etc","type":"array","maxItems":1000,"items":{"type":"string"}},"description":{"description":"Description of the alert","type":"string"},"dstports":{},"duration":{"description":"Time in seconds for the current triggered alert metric.","type":"integer"},"end":{"description":"End time of the alert.","type":"integer"},"flowsrcnames":{"description":"Device or Cloud Provider name sending flows","type":"string"},"id":{"type":"string","readOnly":true,"description":"The ID for this alert."},"ipinfo":{"description":"An array of ip info objects that contains the netography known enrichment data for an ip at the time of the alert","type":"array","maxItems":1000,"items":{"type":"object","additionalProperties":false,"properties":{"as":{"description":"ASN object that contains the number and org","type":"object","additionalProperties":false,"properties":{"number":{"description":"AS Number","type":"integer"},"org":{"description":"AS Org","type":"string"}}},"bogon":{"description":"Is this IP bogon?","type":"boolean"},"count":{"description":"Number of times this IP has been seen","type":"integer"},"firstseen":{"description":"timestamp of when this IP was first seen by Netography","type":"integer"},"geo":{"description":"geo data for this ip","type":"object","additionalProperties":false,"properties":{"city":{"description":"Name of the city","type":"string"},"continentcode":{"description":"Continent code","type":"string"},"countrycode":{"description":"Country code","type":"string"},"location":{"description":"Latitude & Longitude Object","type":"object","additionalProperties":false,"properties":{"lat":{"description":"Latitude","type":"number","minimum":-90,"maximum":90},"lon":{"description":"Longitude","type":"number","minimum":-180,"maximum":180}}},"postal":{"description":"Postal code","type":"string"},"subdiso":{"description":"Name of the subdivision iso code","type":"string"},"subdivisionb":{"description":"Name of the additional subdivision","type":"string"}}},"ip":{"description":"IP address this info applies to","type":"string"},"iprep":{"description":"IP Reputation information for this IP","type":"object","additionalProperties":false,"properties":{"categories":{"description":"The IP reputation categories this IP belongs to.","type":"array","maxItems":1000,"items":{"type":"string"}},"count":{"description":"Number of IP reputation categories this IP belongs to","type":"integer"}}},"lastseen":{"description":"timestamp of when this IP was first seen by Netography","type":"integer"},"pdns":{"description":"Passive DNS information for this IP","type":"object","additionalProperties":false,"properties":{"count":{"description":"Number of passive DNS records for this IP","type":"integer"},"records":{"description":"The passive DNS records that were found during the event duration","type":"array","maxItems":1000,"items":{"type":"string"}}}},"rdns":{"description":"Reverse DNS for this ip","type":"array","maxItems":1000,"items":{"type":"string"}}}}},"ipinfocount":{"description":"number of IPs extend information was fetched on.","type":"integer"},"metrics":{"type":"object","additionalProperties":false,"properties":{"bits":{"type":"object","additionalProperties":false,"properties":{"min":{"description":"The minumum value for the current triggered alert metric.","type":"integer"},"max":{"description":"The maximum value for the current triggered alert metric.","type":"integer"},"avg":{"description":"The average value for the current triggered alert metric.","type":"number"},"sum":{"description":"The sum of the values for the current triggered alert metric.","type":"number"}}},"bitsxrate":{"type":"object","additionalProperties":false,"properties":{"min":{"description":"The minumum value for the current triggered alert metric.","type":"integer"},"max":{"description":"The maximum value for the current triggered alert metric.","type":"integer"},"avg":{"description":"The average value for the current triggered alert metric.","type":"number"},"sum":{"description":"The sum of the values for the current triggered alert metric.","type":"number"}}},"packets":{"type":"object","additionalProperties":false,"properties":{"min":{"description":"The minumum value for the current triggered alert metric.","type":"integer"},"max":{"description":"The maximum value for the current triggered alert metric.","type":"integer"},"avg":{"description":"The average value for the current triggered alert metric.","type":"number"},"sum":{"description":"The sum of the values for the current triggered alert metric.","type":"number"}}},"packetsxrate":{"type":"object","additionalProperties":false,"properties":{"min":{"description":"The minumum value for the current triggered alert metric.","type":"integer"},"max":{"description":"The maximum value for the current triggered alert metric.","type":"integer"},"avg":{"description":"The average value for the current triggered alert metric.","type":"number"},"sum":{"description":"The sum of the values for the current triggered alert metric.","type":"number"}}}}},"rollupperiod":{"description":"Time in seconds looked back for calculating the alert metric.","type":"integer"},"rulecount":{"description":"Number of response policies (rules) that fired from this alert","type":"integer"},"rules":{"description":"Response policies (rules) that fired with this alert","type":"array","maxItems":1000,"items":{"type":"string"}},"search":{"description":"NQL used","type":"string"},"severity":{"description":"Severity of the alert.","type":"string"},"sites":{"description":"The site of the alert.","type":"string"},"srcports":{},"start":{"description":"Start time of the alert.","type":"integer"},"summary":{"description":"Human readable summary of the alert.","type":"string"},"tag":{"description":"Tag associated with the alert if applicable","type":"string"},"tags":{"description":"Tag associated with the alert if applicable","type":"array","maxItems":1000,"items":{"type":"string"}},"threshold":{"description":"Threshold for this detection model (algorithm)","type":"string"},"timestamp":{"description":"Unix timestamp for the alert.","type":"integer"},"track":{"description":"The object string that the detection model (algorithm) uses to track, this can be different than the objectfield value).","type":"string"},"track_by":{"description":"The field that identifies the object (dstip, flowsrcname, tag, input, output).","type":"array","maxItems":5,"items":{"type":"string"}},"updateinterval":{"description":"Time in seconds updates are sent out.","type":"integer"}}}}}}
```
## The ApiKeyConfigCreate object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ApiKeyConfigCreate":{"description":"API Key Create Config","type":"object","required":["appname","roles"],"properties":{"appname":{"description":"API Key Name","type":"string"},"description":{"description":"API Key Description","type":"string"},"roles":{"description":"An array containing strings which include the role name the user should be assigned to.","type":"array","items":{"type":"string"}}}}}}}
```
## The ApiKeyConfigUpdate object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ApiKeyConfigUpdate":{"description":"API Key Update Config","type":"object","properties":{"description":{"description":"API Key Description","type":"string"},"roles":{"description":"An array containing strings which include the role name the user should be assigned to.","type":"array","items":{"type":"string"}}}}}}}
```
## The ApiKeyRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ApiKeyRecord":{"description":"API Key Record","type":"object","properties":{"appname":{"type":"string","readOnly":true,"description":"API Key Name"},"description":{"type":"string","description":"API Key Description"},"roles":{"type":"array","maxItems":1,"items":{"type":"string"},"description":"An array containing strings which include the role name the user should be assigned to."},"last_login":{"type":"number","readOnly":true,"description":"Unix timestamp of last login"},"last_ip":{"type":"string","readOnly":true,"description":"Last IP address used to login"}}}}}}
```
## The AsnRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"AsnRecord":{"type":"object","additionalProperties":false,"description":"ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.","properties":{"number":{"description":"AS number looked up","type":"integer"},"org":{"description":"AS Org for this AS number","type":"string"}}}}}}
```
## The AuditRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"AuditRecord":{"description":"Audit Log Record","type":"object","additionalProperties":false,"properties":{"action":{"description":"What operation was done to generate the record","type":"string"},"class":{"description":"The audit class of the record","type":"string"},"description":{"description":"User summary of the record","type":"string"},"id":{"type":"string","readOnly":true,"description":"The unique ID, as an UUID, of the audit record"},"impersonator":{"description":"The user id of the impersonator of the change","type":"string"},"new_object":{"description":"The new object subject to the audit record","type":"object"},"original_id":{"type":"string","readOnly":true,"description":"The id of the object subject to the audit record"},"original_object":{"description":"The original object subject to the audit record","type":"object"},"subclass":{"description":"The audit subclass of the record","type":"string"},"timestamp":{"description":"Epoch timestamp","type":"integer"},"user":{"description":"The user id of the user of the change","type":"string"}}}}}}
```
## The BgpNeighborCommon object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"BgpNeighborCommon":{"type":"object","properties":{"addresslocal":{"type":"string"},"addressremote":{"type":"string"},"admindown":{"type":"boolean"},"advanced":{"type":"boolean"},"asn":{"type":"string"},"authpassword":{"type":"string"},"description":{"type":"string"},"deviceid":{"type":"string"},"gracefulrestart":{"type":"boolean"},"holdtime":{"type":"integer"},"ipv4-flowspec":{"type":"boolean"},"ipv4-unicast":{"type":"boolean"},"ipv6-flowspec":{"type":"boolean"},"ipv6-unicast":{"type":"boolean"},"keepalive":{"type":"integer"},"negotiated":{"type":"object","properties":{"capabilities":{"type":"array"},"holdtime":{"type":"integer"},"keepalive":{"type":"integer"}}},"restarttime":{"type":"integer"},"routes":{"type":"object","properties":{"ipv4-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv4-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"total":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"prefixrate":{"type":"integer"},"prefixsessioncount":{"type":"integer"},"prefixtotalcount":{"type":"integer"},"received":{"type":"integer"}}}}},"state":{"type":"string"},"stats":{"type":"object","properties":{"recv":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}},"sent":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}}}},"uptime":{"type":"string"}}}}}}
```
## The BgpNeighborConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"BgpNeighborConfig":{"description":"BGP Neighbor Create or Update Config","type":"object","allOf":[{"type":"object","properties":{"addresslocal":{"type":"string"},"addressremote":{"type":"string"},"admindown":{"type":"boolean"},"advanced":{"type":"boolean"},"asn":{"type":"string"},"authpassword":{"type":"string"},"description":{"type":"string"},"deviceid":{"type":"string"},"gracefulrestart":{"type":"boolean"},"holdtime":{"type":"integer"},"ipv4-flowspec":{"type":"boolean"},"ipv4-unicast":{"type":"boolean"},"ipv6-flowspec":{"type":"boolean"},"ipv6-unicast":{"type":"boolean"},"keepalive":{"type":"integer"},"negotiated":{"type":"object","properties":{"capabilities":{"type":"array"},"holdtime":{"type":"integer"},"keepalive":{"type":"integer"}}},"restarttime":{"type":"integer"},"routes":{"type":"object","properties":{"ipv4-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv4-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"total":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"prefixrate":{"type":"integer"},"prefixsessioncount":{"type":"integer"},"prefixtotalcount":{"type":"integer"},"received":{"type":"integer"}}}}},"state":{"type":"string"},"stats":{"type":"object","properties":{"recv":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}},"sent":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}}}},"uptime":{"type":"string"}}}],"required":["addressremote","description","asn"]}}}}
```
## The BgpNeighborRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"BgpNeighborRecord":{"description":"BGP Neighbor Record","type":"object","allOf":[{"type":"object","properties":{"addresslocal":{"type":"string"},"addressremote":{"type":"string"},"admindown":{"type":"boolean"},"advanced":{"type":"boolean"},"asn":{"type":"string"},"authpassword":{"type":"string"},"description":{"type":"string"},"deviceid":{"type":"string"},"gracefulrestart":{"type":"boolean"},"holdtime":{"type":"integer"},"ipv4-flowspec":{"type":"boolean"},"ipv4-unicast":{"type":"boolean"},"ipv6-flowspec":{"type":"boolean"},"ipv6-unicast":{"type":"boolean"},"keepalive":{"type":"integer"},"negotiated":{"type":"object","properties":{"capabilities":{"type":"array"},"holdtime":{"type":"integer"},"keepalive":{"type":"integer"}}},"restarttime":{"type":"integer"},"routes":{"type":"object","properties":{"ipv4-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv4-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-flow":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"ipv6-unicast":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"received":{"type":"integer"}}},"total":{"type":"object","properties":{"accepted":{"type":"integer"},"advertised":{"type":"integer"},"prefixrate":{"type":"integer"},"prefixsessioncount":{"type":"integer"},"prefixtotalcount":{"type":"integer"},"received":{"type":"integer"}}}}},"state":{"type":"string"},"stats":{"type":"object","properties":{"recv":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}},"sent":{"type":"object","properties":{"discarded":{"type":"integer"},"keepalives":{"type":"integer"},"notifications":{"type":"integer"},"opens":{"type":"integer"},"routerefreshes":{"type":"integer"},"updates":{"type":"integer"},"withdrawprefix":{"type":"integer"},"withdrawupdate":{"type":"integer"}}}}},"uptime":{"type":"string"}}}],"properties":{"id":{"type":"string"}}}}}}
```
## The BlockRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"BlockRecord":{"description":"Block Record","type":"object"}}}}
```
## The ContextCreationModelCommon object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ContextCreationModelCommon":{"type":"object","properties":{"action":{"description":"Action for the context model","type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"field":{"type":"string"},"context":{"type":"string"},"labels":{"type":"array","items":{"type":"string"}}}}},"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the context model","type":"array","items":{"type":"string"}},"description":{"description":"Context model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the context model is enabled","type":"boolean"},"expiration":{"description":"Number of seconds the context creation model will remain active","type":"integer"},"factors":{"description":"Factors for the context model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the context model","type":"string"},"rollupperiod":{"description":"The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the context model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the context model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the context model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the context model","type":"string","enum":["flow","dns"]}}}}}}
```
## The ContextCreationModelConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ContextCreationModelConfig":{"description":"Context Creation Model Create or Update Config","type":"object","required":["description","expiration","name","rollupperiod","search_by","thresholds","track_by","algo_record_type"],"allOf":[{"type":"object","properties":{"action":{"description":"Action for the context model","type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"field":{"type":"string"},"context":{"type":"string"},"labels":{"type":"array","items":{"type":"string"}}}}},"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the context model","type":"array","items":{"type":"string"}},"description":{"description":"Context model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the context model is enabled","type":"boolean"},"expiration":{"description":"Number of seconds the context creation model will remain active","type":"integer"},"factors":{"description":"Factors for the context model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the context model","type":"string"},"rollupperiod":{"description":"The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the context model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the context model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the context model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the context model","type":"string","enum":["flow","dns"]}}}]}}}}
```
## The ContextCreationModelRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ContextCreationModelRecord":{"description":"Context Creation Model Record","type":"object","allOf":[{"type":"object","properties":{"action":{"description":"Action for the context model","type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"field":{"type":"string"},"context":{"type":"string"},"labels":{"type":"array","items":{"type":"string"}}}}},"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the context model","type":"array","items":{"type":"string"}},"description":{"description":"Context model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the context model is enabled","type":"boolean"},"expiration":{"description":"Number of seconds the context creation model will remain active","type":"integer"},"factors":{"description":"Factors for the context model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the context model","type":"string"},"rollupperiod":{"description":"The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the context model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the context model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the context model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the context model","type":"string","enum":["flow","dns"]}}}],"properties":{"algo_type":{"description":"Context model type","type":"string"},"beta":{"description":"If true, it's a beta context model","type":"boolean"},"created":{"description":"The time at which record was created","type":"integer"},"id":{"description":"Context model ID","type":"string"},"recommended":{"description":"If true, it's a recomended context model","type":"boolean"},"subscription":{"description":"Subscription for the context model","type":"object","properties":{"all":{"type":"string"}}},"subscriptiontype":{"description":"Subscription type for the context model","type":"string"},"system":{"description":"If true, it's a system context model","type":"boolean"},"systemdefault":{"description":"If true, it's a system default context model","type":"boolean"},"updated":{"description":"The time at which record was was last updated","type":"integer"}}}}}}
```
## The DetectionCategoryConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"DetectionCategoryConfig":{"description":"Detection Category Create or Update Config","type":"object","properties":{"description":{"description":"Detection category description","type":"string"}}}}}}
```
## The DetectionCategoryRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"DetectionCategoryRecord":{"description":"Detection Category Record","type":"object","properties":{"description":{"description":"Detection category description","type":"string"},"name":{"description":"Detection category name","type":"string"},"system":{"description":"If true, it's a system detection category","type":"boolean"},"systemdefault":{"description":"If true, it's a system default detection category","type":"boolean"}}}}}}
```
## The DeviceConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"DeviceConfig":{"required":["name","ips","samplerate"],"additionalProperties":false,"properties":{"name":{"description":"The name of the device. Eg. router1.site.company.com","type":"string"},"ips":{"description":"An array of IPs that this device sends flows from.","type":"array","items":{"type":"string","format":"cidr"}},"samplerate":{"description":"The samplerate of flows this device will send.","type":"integer","format":"int32","minimum":1,"maximum":65535},"payload":{"description":"Whether to store payload sample or not. SFLOW only. Default to false if not set.","type":"boolean"},"tags":{"description":"An array of strings to tag every flow from this device with.","type":"array","items":{"type":"string"}},"site":{"description":"The site identifier for this device.","type":"string"}}}}}}
```
## The DnsRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"DnsRecord":{"description":"DNS Record","type":"object","additionalProperties":false,"properties":{"accountid":{"description":"Account ID","type":"string"},"action":{"description":"Action that was taken on this query (cloud only)","type":"string"},"answercount":{"description":"The number of answers returned","type":"integer"},"answers":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","description":"the DNS answer type"},"rdata":{"type":"string","description":"the DNS answer rdata"},"class":{"type":"string","description":"the DNS answer class"}}}},"datasrc":{"description":"Device or Cloud Provider name sending dns","type":"string"},"id":{"description":"The unique ID, as an UUID, of the DNS record","type":"string"},"instanceid":{"description":"Instance ID","type":"string"},"internal":{"description":"Is this query name for an internal domain","type":"boolean"},"label":{"type":"object","properties":{"ip":{"type":"object","description":"IP labels for all contexts"},"port":{"type":"object","description":"Port labels for all protocols"}}},"protocol":{"description":"Protocol of the query","type":"string"},"provider":{"description":"Is the answer a provider","type":"boolean"},"providername":{"description":"The name of the provider","type":"string"},"query":{"type":"object","properties":{"class":{"description":"DNS query class","type":"string"},"depth":{"description":"DNS query depth","type":"integer"},"domain":{"description":"DNS query domain","type":"string"},"host":{"description":"DNS query host","type":"string"},"name":{"description":"DNS query name","type":"string"},"publicsuffix":{"description":"DNS query domain under which multiple parties that are unaffiliated with the operator of the domain may register subdomains","type":"string"},"tld":{"description":"DNS query tld","type":"string"},"type":{"description":"DNS query type","type":"string"}}},"rcode":{"description":"the DNS rcode","type":"string"},"region":{"description":"Region","type":"string"},"rtime":{"description":"The time the record was received","type":"string"},"site":{"description":"The site name the DNS request was sent from. Site names can be managed in Devices","type":"string"},"srcip":{"description":"Source IP of the DNS request","type":"string"},"srcport":{"description":"Source port of the DNS request","type":"integer"},"timestamp":{"description":"Unix timestamp for the dns request.","type":"integer"},"type":{"description":"the DNS Type","type":"string"},"version":{"description":"the DNS version","type":"string"},"vpcid":{"description":"VPC Id","type":"string"}}}}}}
```
## The DnsclassCommon object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"DnsclassCommon":{"type":"object","properties":{"domains":{"type":"array","items":{"type":"string"},"description":"The list of internal domains"}}}}}}
```
## The DnsclassConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"DnsclassConfig":{"description":"DNS Classification Create or Update Config","type":"object","allOf":[{"type":"object","properties":{"domains":{"type":"array","items":{"type":"string"},"description":"The list of internal domains"}}}],"required":["domains"]}}}}
```
## The DnsclassRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"DnsclassRecord":{"description":"DNS Classification Record","type":"object","allOf":[{"type":"object","properties":{"domains":{"type":"array","items":{"type":"string"},"description":"The list of internal domains"}}}],"properties":{"id":{"type":"string","description":"The unique identifier for the dns classification."}}}}}}
```
## The Error object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"Error":{"type":"object","required":["status","name","message"],"additionalProperties":false,"properties":{"status":{"description":"API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n","type":"integer","readOnly":true,"format":"int32"},"name":{"description":"They type of error","type":"string","readOnly":true},"message":{"description":"description of the error","type":"string","readOnly":true}}}}}}
```
## The FlowRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"FlowRecord":{"description":"Flow Record","type":"object","additionalProperties":false,"properties":{"action":{"description":"Whether the flow was accepted or rejected. AWS only.","type":"string"},"bits":{"description":"Number of bits.","type":"integer"},"bogonsrc":{"description":"Is source IP bogon?","type":"boolean"},"bogondst":{"description":"Is destination IP bogon?","type":"boolean"},"dstas":{"type":"object","description":"Autonymous System Object","additionalProperties":false,"properties":{"number":{"description":"Destination AS the traffic came from.","type":"integer"},"org":{"description":"Destination AS Organization the traffic came from.","type":"string"}}},"dstgeo":{"type":"object","description":"Destination Geolocation Object","additionalProperties":false,"properties":{"countrycode":{"description":"Country code of destination IP.","type":"string"},"continentcode":{"description":"Continent of destination IP.","type":"string"},"location":{"type":"object","description":"Latitude & Longitude Object","additionalProperties":false,"properties":{"lat":{"description":"Latitude of the destination IP.","type":"number","minimum":-90,"maximum":90},"lon":{"description":"Longitude of the destination IP.","type":"number","minimum":-180,"maximum":180}}}}},"dstinternal":{"description":"Is the destination an internal IP?","type":"boolean"},"dstip":{"description":"Destination IP for the flow.","type":"string"},"dstiprep":{"type":"object","description":"Destination IP Reputation Object","additionalProperties":false,"properties":{"count":{"description":"Number of IP Reputation categories the destination IP belongs to.","type":"integer"},"categories":{"description":"The IP Reputation categories the destination ip belongs to.","type":"array","maxItems":1000,"items":{"type":"string"}}}},"dstowneras":{"type":"object","description":"Autonymous System Object","additionalProperties":false,"properties":{"number":{"description":"AS number of the destination IP owner.","type":"integer"},"org":{"description":"AS Organization of the destination IP owner.","type":"string"}}},"dstport":{"description":"Destination port for the flow.","type":"integer"},"dstvlan":{"description":"Destination VLAN.","type":"integer"},"duration":{"description":"Duration of the flow in ms.","type":"integer"},"end":{"description":"End of the flow if it could be calculated (netflow only)","type":"integer"},"flowbrate":{"description":"The rate of bits for this flow. Netflow/VPC flow only","type":"number"},"flowprate":{"description":"The rate of packets for this flow. Netflow/VPC flow only","type":"number"},"flowsrcname":{"description":"Device or Cloud Provider name sending flows","type":"string"},"flowsrcip":{"description":"Device sending IP of flow.","type":"string"},"flowtype":{"description":"Type of flow for this flow. Eg. aws, netflow, sflow.","type":"string"},"flowversion":{"description":"Version of the flow being sent.","type":"integer"},"icmpcode":{"description":"ICMP code V10 only.","type":"string"},"icmptype":{"description":"ICMP type","type":"string"},"ipversion":{"description":"Version of the IP protocol for this flow.","type":"integer"},"input":{"description":"Input (index) interface.","type":"integer"},"inputalias":{"description":"Alias for input interface.","type":"string"},"inputclasses":{"description":"Interface classes the input interface belongs to.","type":"array","maxItems":1000,"items":{"type":"string"}},"inputname":{"description":"Nescription of the input interface.","type":"string"},"nexthop":{"description":"IP address of the next hop.","type":"string"},"output":{"description":"Output (index) interface.","type":"integer"},"outputalias":{"description":"Alias for output interface.","type":"string"},"outputclasses":{"description":"Interface classes the output interface belongs to.","type":"array","maxItems":1000,"items":{"type":"string"}},"outputname":{"description":"Name for output interface.","type":"string"},"packets":{"description":"Number of packets.","type":"integer"},"pbratio":{"description":"Ratio of packets to bits for this flow (packets/bits).","type":"number"},"protocol":{"description":"Protocol of the flow.","type":"string"},"protocolint":{"description":"Integer representation of the protocol of the flow.","type":"integer"},"site":{"description":"Site for this device/VPC.","type":"string"},"srcas":{"type":"object","description":"Autonymous System Object","additionalProperties":false,"properties":{"number":{"description":"Source AS the traffic came from.","type":"integer"},"org":{"description":"Source AS Organization the traffic came from.","type":"string"}}},"srcgeo":{"type":"object","description":"Source Geolocation Object","additionalProperties":false,"properties":{"countrycode":{"description":"Country code of source IP.","type":"string"},"continentcode":{"description":"Continent of source IP.","type":"string"},"location":{"type":"object","description":"Latitude & Longitude Object","additionalProperties":false,"properties":{"lat":{"description":"Latitude of the source IP.","type":"number","minimum":-90,"maximum":90},"lon":{"description":"Longitude of the source IP.","type":"number","minimum":-180,"maximum":180}}}}},"srcinternal":{"description":"Is the source an internal IP?","type":"boolean"},"srcip":{"description":"Source IP for the flow.","type":"string"},"srciprep":{"type":"object","description":"Source IP Reputation Object","additionalProperties":false,"properties":{"count":{"description":"Number of IP Reputation categories the source IP belongs to.","type":"integer"},"categories":{"description":"The IP Reputation categories the source ip belongs to.","type":"array","maxItems":1000,"items":{"type":"string"}}}},"srcowneras":{"type":"object","description":"Autonymous System Object","additionalProperties":false,"properties":{"number":{"description":"AS number of the source IP owner.","type":"integer"},"org":{"description":"AS Organization of the source IP owner","type":"string"}}},"srcport":{"description":"Source port for the flow.","type":"integer"},"srcvlan":{"description":"Source VLAN.","type":"integer"},"start":{"description":"Start of the flow if it could be calculated (netflow only)","type":"integer"},"tags":{"description":"User defined metadata.","type":"array","maxItems":1000,"items":{"type":"string"}},"timestamp":{"description":"Unix timestamp for the flow.","type":"integer"},"tcpflagsint":{"description":"Integer value representing ALL TCP flags.","type":"integer"},"tcpflags":{"type":"object","description":"TCP Flags Object","additionalProperties":false,"properties":{"ack":{"description":"Was tcp flag ACK set?","type":"boolean"},"cwr":{"description":"Was tcp flag CWR set?","type":"boolean"},"ece":{"description":"Was tcp flag ECE set?","type":"boolean"},"fin":{"description":"Was tcp flag FIN set?","type":"boolean"},"ns":{"description":"Was tcp flag NS set?","type":"boolean"},"psh":{"description":"Was tcp flag PSH set?","type":"boolean"},"rst":{"description":"Was tcp flag RST set?","type":"boolean"},"syn":{"description":"Was tcp flag SYN set?","type":"boolean"},"urg":{"description":"Was tcp flag URG set?","type":"boolean"}}},"tos":{"description":"Type of service set on the flow.","type":"integer"}}}}}}
```
## The FlowTagConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"FlowTagConfig":{"required":["name","tags"],"additionalProperties":false,"properties":{"name":{"description":"The name of the Flow Tag Rule. Eg. carrier tags","type":"string"},"tags":{"description":"An array of strings to tag every flow that matches this response policy (rule) with","type":"array","items":{"type":"string"}},"inputaliasregex":{"description":"A regular expression that matches against inputalias of a given flow record.","type":"string"},"inputnameregex":{"description":"A regular expression that matches against inputname of the input interface of a given flow record.","type":"string"},"outputaliasregex":{"description":"A regular expression that matches against outputalias of a given flow record.","type":"string"},"outputnameregex":{"description":"A regular expression that matches against outputname of a given flow record.","type":"string"},"srcnets":{"description":"An array of CIDR blocks to match against the source IP for a given flow record.","type":"array","items":{"type":"string"}},"dstnets":{"description":"An array of CIDR blocks to match against the destination IP for a given flow record.","type":"array","items":{"type":"string"}},"srcport":{"description":"Source port to match against a given flow.","type":"integer","format":"int32"},"dstport":{"description":"Destination port to match against a given flow.","type":"integer","format":"int32"},"protocol":{"description":"lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc","type":"string"},"tcpflagsint":{"description":"integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.","type":"integer","format":"int32"},"srcas":{"description":"An array of AS numbers to match against the source AS for a given flow record.","type":"array","items":{"type":"integer"}},"dstas":{"description":"An array of AS numbers to match against the destination AS for a given flow record.","type":"array","items":{"type":"integer"}},"srcowneras":{"description":"An array of AS numbers to match against the AS of the source IP for a given flow record.","type":"array","items":{"type":"integer"}},"dstowneras":{"description":"An array of AS numbers to match against the AS of the destination IP for a given flow record.","type":"array","items":{"type":"integer"}}}}}}}
```
## The Format object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"Format":{"title":"format","description":"Series data can be provided in a variety of formats which are native to some charting libraries. e.g. amcharts or highcharts","type":"string","default":"highcharts","enum":["amcharts","d3","highcharts","png"]}}}}
```
## The IntegrationsContext object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContext":{"description":"List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.","type":"object","required":["name","type","enabled","updateinterval"],"allOf":[{"type":"object","properties":{"name":{"type":"string","description":"The name of the context integration"},"type":{"type":"string","description":"The type of the context integration. The configuration parameters are dependent on this value.","enum":["aws","azure","crowdstrike","crowdstrikediscover","ibm","oracle","gcp","s3"]},"enabled":{"type":"boolean","description":"The state of the context integration. Whether to auto update or not."},"updateinterval":{"type":"integer","description":"The number of seconds by which to poll the integration.","minimum":3600,"maximum":604800,"format":"int32"},"aws":{"type":"object","description":"Configuration options specific to type aws. nil if not configuring AWS","required":["awsauthtype","region"],"additionalProperties":false,"properties":{"region":{"type":"string","description":"The aws region to authenticate to"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in AWS"},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}}}},"azure":{"type":"object","description":"Configuration options specific to type azure. nil if not configuring Azure","required":["clientid","clientsecret","subscriptionid","tenantid"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to use authenticating with azure","type":"string"},"clientsecret":{"description":"The client secret to use authenticating with azure","type":"string"},"subscriptionid":{"type":"string","description":"The azure subscription id to be queried"},"tenantid":{"type":"string","description":"The azure tenant id to use"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in Azure"}}},"crowdstrike":{"type":"object","description":"Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.","required":["clientid","clientsecret","cloud"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to authenticate to the Falcon cloud api","type":"string"},"clientsecret":{"description":"The client secret to authenticate to the Falcon cloud api","type":"string"},"cloud":{"type":"string","description":"The Falcon cloud abbreviation to query","enum":["us-1","us-2","eu-1","us-gov-1"]},"filter":{"type":"string","description":"An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d"},"sort":{"type":"string","description":"An optional FQL sort string, e.g. last_seen_timestamp.desc"}}},"crowdstrikediscover":{"type":"object","description":"Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.","required":["clientid","clientsecret","cloud"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to authenticate to the Falcon cloud api","type":"string"},"clientsecret":{"description":"The client secret to authenticate to the Falcon cloud api","type":"string"},"cloud":{"type":"string","description":"The Falcon cloud abbreviation to query","enum":["us-1","us-2","eu-1","us-gov-1"]},"filter":{"type":"string","description":"An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d"},"sort":{"type":"string","description":"An optional FQL sort string, e.g. last_seen_timestamp.desc"}}},"ibm":{"type":"object","description":"Configuration options specific to ibm. nil if not configuring IBM Cloud","required":["apikey","region"],"properties":{"apikey":{"description":"The api key to use for authentication","type":"string"},"region":{"type":"string","description":"The IBM region to query"}}},"oracle":{"type":"object","description":"Configuration options specific to oracle. nil if not configuring Oracle Cloud","required":["user","tenancy","region"],"additionalProperties":false,"properties":{"user":{"description":"The user ocid to use for authentication to oracle cloud","type":"string"},"tenancy":{"description":"The tenancy ocid to use for connecting to oracle cloud","type":"string"},"region":{"type":"string","description":"The region of oracle cloud to connect to"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in oracle cloud"}}},"gcp":{"type":"object","description":"Configuration options specific to gcp. nil if not configuring GCP","required":["zone","credentials"],"additionalProperties":false,"properties":{"zone":{"description":"The GCP zone for this configuration","type":"string"},"credentials":{"type":"object","description":"The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.","additionalProperties":false,"required":["type","project_id","private_key_id","private_key","client_email","client_id","auth_uri","token_uri","auth_provider_x509_cert_url","client_x509_cert_url"],"properties":{"type":{"type":"string","description":"Credential type. this will typically be \"service_account\""},"project_id":{"type":"string","description":"The project id of the account"},"private_key_id":{"type":"string","description":"The private key id of the service account"},"private_key":{"type":"string","description":"The pirvate key to authenticate with"},"client_email":{"type":"string","description":"The email of the service account"},"client_id":{"type":"string","description":"The id of the client"},"auth_uri":{"type":"string","description":"OAth2 uri"},"token_uri":{"type":"string","description":"Token URI"},"auth_provider_x509_cert_url":{"type":"string","description":"Auth cert url"},"client_x509_cert_url":{"type":"string","description":"Client cert url"}}},"labels":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom label names to track in GCP"}}},"s3":{"type":"object","description":"Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n","required":["awsauthtype","region","bucket"],"additionalProperties":false,"properties":{"region":{"type":"string","description":"The aws region to authenticate to"},"bucket":{"type":"string","description":"The name of the s3 bucket from which to pull the csv file."},"path":{"type":"string","description":"The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..."},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}}}},"sentinelone":{"type":"object","description":"Configuration options specific to sentinelone. nil if not configuring SentinelOne","required":["base_url","params","token"],"additionalProperties":false,"properties":{"base_url":{"description":"The SentinelOne domain URL to query, e.g. https://.sentinelone.net ","type":"string"},"params":{"type":"object","additionalProperties":false,"properties":{"accountId":{"type":"string","description":"The SentinelOne account ID to query"},"filterId":{"type":"string","description":"The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000"}}},"token":{"description":"API token to use for authentication","type":"string"},"ranger":{"type":"object","properties":{"enabled":{"type":"boolean"}}}}},"wiz":{"type":"object","description":"Configuration options specific to wiz. nil if not configuring Wiz","required":["apiendpoint","tokenurl","clientid","clientsecret"],"additionalProperties":false,"properties":{"apiendpoint":{"description":"Wiz API Endpoint URL","type":"string","enum":["https://api.us1.app.wiz.io/graphql","https://api.us2.app.wiz.io/graphql","https://api.eu1.app.wiz.io/graphql","https://api.eu2.app.wiz.io/graphql","https://api.us17.app.wiz.io/graphql"]},"tokenurl":{"description":"Wiz Token URL","type":"string","enum":["https://auth.app.wiz.io/oauth/token","https://auth.wiz.io/oauth/token","https://auth.gov.wiz.io/oauth/token","https://auth0.gov.wiz.io/oauth/token"]},"clientid":{"description":"Client id to use authenticating with Wiz API","type":"string"},"clientsecret":{"description":"Client secret to use authenticating with Wiz API","type":"string"}}}}}]}}}}
```
## The IntegrationsContextAws object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContextAws":{"type":"object","description":"Configuration options specific to type aws. nil if not configuring AWS","required":["awsauthtype","region"],"additionalProperties":false,"properties":{"region":{"type":"string","description":"The aws region to authenticate to"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in AWS"},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}}}}}}}
```
## The IntegrationsContextAzure object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContextAzure":{"type":"object","description":"Configuration options specific to type azure. nil if not configuring Azure","required":["clientid","clientsecret","subscriptionid","tenantid"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to use authenticating with azure","type":"string"},"clientsecret":{"description":"The client secret to use authenticating with azure","type":"string"},"subscriptionid":{"type":"string","description":"The azure subscription id to be queried"},"tenantid":{"type":"string","description":"The azure tenant id to use"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in Azure"}}}}}}
```
## The IntegrationsContextCrowdstrike object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContextCrowdstrike":{"type":"object","description":"Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.","required":["clientid","clientsecret","cloud"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to authenticate to the Falcon cloud api","type":"string"},"clientsecret":{"description":"The client secret to authenticate to the Falcon cloud api","type":"string"},"cloud":{"type":"string","description":"The Falcon cloud abbreviation to query","enum":["us-1","us-2","eu-1","us-gov-1"]},"filter":{"type":"string","description":"An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d"},"sort":{"type":"string","description":"An optional FQL sort string, e.g. last_seen_timestamp.desc"}}}}}}
```
## The IntegrationsContextCrowdstrikediscover object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContextCrowdstrikediscover":{"type":"object","description":"Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.","required":["clientid","clientsecret","cloud"],"additionalProperties":false,"properties":{"clientid":{"description":"The client id to authenticate to the Falcon cloud api","type":"string"},"clientsecret":{"description":"The client secret to authenticate to the Falcon cloud api","type":"string"},"cloud":{"type":"string","description":"The Falcon cloud abbreviation to query","enum":["us-1","us-2","eu-1","us-gov-1"]},"filter":{"type":"string","description":"An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d"},"sort":{"type":"string","description":"An optional FQL sort string, e.g. last_seen_timestamp.desc"}}}}}}
```
## The IntegrationsContextGcp object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContextGcp":{"type":"object","description":"Configuration options specific to gcp. nil if not configuring GCP","required":["zone","credentials"],"additionalProperties":false,"properties":{"zone":{"description":"The GCP zone for this configuration","type":"string"},"credentials":{"type":"object","description":"The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.","additionalProperties":false,"required":["type","project_id","private_key_id","private_key","client_email","client_id","auth_uri","token_uri","auth_provider_x509_cert_url","client_x509_cert_url"],"properties":{"type":{"type":"string","description":"Credential type. this will typically be \"service_account\""},"project_id":{"type":"string","description":"The project id of the account"},"private_key_id":{"type":"string","description":"The private key id of the service account"},"private_key":{"type":"string","description":"The pirvate key to authenticate with"},"client_email":{"type":"string","description":"The email of the service account"},"client_id":{"type":"string","description":"The id of the client"},"auth_uri":{"type":"string","description":"OAth2 uri"},"token_uri":{"type":"string","description":"Token URI"},"auth_provider_x509_cert_url":{"type":"string","description":"Auth cert url"},"client_x509_cert_url":{"type":"string","description":"Client cert url"}}},"labels":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom label names to track in GCP"}}}}}}
```
## The IntegrationsContextIbm object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContextIbm":{"type":"object","description":"Configuration options specific to ibm. nil if not configuring IBM Cloud","required":["apikey","region"],"properties":{"apikey":{"description":"The api key to use for authentication","type":"string"},"region":{"type":"string","description":"The IBM region to query"}}}}}}
```
## The IntegrationsContextOracle object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContextOracle":{"type":"object","description":"Configuration options specific to oracle. nil if not configuring Oracle Cloud","required":["user","tenancy","region"],"additionalProperties":false,"properties":{"user":{"description":"The user ocid to use for authentication to oracle cloud","type":"string"},"tenancy":{"description":"The tenancy ocid to use for connecting to oracle cloud","type":"string"},"region":{"type":"string","description":"The region of oracle cloud to connect to"},"tags":{"type":"array","items":{"type":"string"},"description":"An array of strings to match any custom tag names to track in oracle cloud"}}}}}}
```
## The IntegrationsContextS3 object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContextS3":{"type":"object","description":"Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n","required":["awsauthtype","region","bucket"],"additionalProperties":false,"properties":{"region":{"type":"string","description":"The aws region to authenticate to"},"bucket":{"type":"string","description":"The name of the s3 bucket from which to pull the csv file."},"path":{"type":"string","description":"The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..."},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}}}}}}}
```
## The IntegrationsContextSentinelone object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContextSentinelone":{"type":"object","description":"Configuration options specific to sentinelone. nil if not configuring SentinelOne","required":["base_url","params","token"],"additionalProperties":false,"properties":{"base_url":{"description":"The SentinelOne domain URL to query, e.g. https://.sentinelone.net ","type":"string"},"params":{"type":"object","additionalProperties":false,"properties":{"accountId":{"type":"string","description":"The SentinelOne account ID to query"},"filterId":{"type":"string","description":"The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000"}}},"token":{"description":"API token to use for authentication","type":"string"},"ranger":{"type":"object","properties":{"enabled":{"type":"boolean"}}}}}}}}
```
## The IntegrationsContextWiz object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsContextWiz":{"type":"object","description":"Configuration options specific to wiz. nil if not configuring Wiz","required":["apiendpoint","tokenurl","clientid","clientsecret"],"additionalProperties":false,"properties":{"apiendpoint":{"description":"Wiz API Endpoint URL","type":"string","enum":["https://api.us1.app.wiz.io/graphql","https://api.us2.app.wiz.io/graphql","https://api.eu1.app.wiz.io/graphql","https://api.eu2.app.wiz.io/graphql","https://api.us17.app.wiz.io/graphql"]},"tokenurl":{"description":"Wiz Token URL","type":"string","enum":["https://auth.app.wiz.io/oauth/token","https://auth.wiz.io/oauth/token","https://auth.gov.wiz.io/oauth/token","https://auth0.gov.wiz.io/oauth/token"]},"clientid":{"description":"Client id to use authenticating with Wiz API","type":"string"},"clientsecret":{"description":"Client secret to use authenticating with Wiz API","type":"string"}}}}}}
```
## The IntegrationsResponse object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponse":{"description":"List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.","type":"object","required":["adapter","name","description"],"allOf":[{"type":"object","additionalProperties":false,"properties":{"adapter":{"type":"string","description":"The type of response integration. The config object is dependant on this.","enum":["bgp","blocklist","crowdstrike","email","flowspec","flowspec_custom","ns1","pagerduty","route53","rtbh","slack","syslog","teams","twilio","webhook"]},"name":{"type":"string","description":"The name of the response integration"},"description":{"type":"string","description":"The description of the response integration."},"config":{"oneOf":[{"type":"object","required":["expiration","community","factors","max","neighbors","nexthop"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"community":{"type":"string"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"nexthop":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["factors","expiration","max"],"additionalProperties":false,"properties":{"factors":{"type":"array","items":{"type":"string"}},"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"max":{"type":"integer"},"whitelist":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["expiration","factors","max","url","client_id","client_secret"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"url":{"description":"Crowdstrike base API URL, can be found in your crowdstrike account","type":"string"},"client_id":{"type":"string"},"client_secret":{"type":"string"}}},{"type":"object","required":["recipients","cc","bcc"],"additionalProperties":false,"properties":{"recipients":{"type":"array","items":{"type":"string"}},"cc":{"type":"array","items":{"type":"string"}},"bcc":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["expiration","factors","max","neighbors"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"whitelist":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["expiration","factors","max","neighbors","rule"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"rule":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["apikey","domain","link","type","zone"],"additionalProperties":false,"properties":{"apikey":{"description":"API Key","type":"string"},"domain":{"type":"string"},"link":{"type":"string"},"type":{"type":"string","description":"Record type"},"zone":{"type":"string"}}},{"type":"object","required":["apikey","integrationkey","severity"],"additionalProperties":false,"properties":{"apikey":{"type":"string"},"integrationkey":{"type":"string"},"severity":{"type":"string"}}},{"type":"object","required":["accesskeyid","aliastarget","evaluatetargethealth","hostedzoneid","name","secretaccesskey","type"],"additionalProperties":false,"properties":{"accesskeyid":{"type":"string"},"aliastarget":{"type":"object"},"evaluatetargethealth":{"type":"boolean"},"hostedzoneid":{"type":"string"},"name":{"type":"string"},"secretaccesskey":{"type":"string"},"type":{"type":"string","description":"Record type"}}},{"type":"object","required":["expiration","community","factors","max","neighbors","nexthop"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"community":{"type":"string"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"nexthop":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}},{"type":"object","required":["url","channel"],"additionalProperties":false,"properties":{"url":{"type":"string"},"channel":{"type":"string"}}},{"type":"object","required":["host","facility","protocol","tag","output"],"additionalProperties":false,"properties":{"host":{"type":"string","description":"combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port."},"facility":{"type":"string","description":"LOG_LOCAL0 is a safe default","enum":["LOG_KERN","LOG_USER","LOG_MAIL","LOG_DAEMON","LOG_AUTH","LOG_SYSLOG","LOG_LPR","LOG_NEWS","LOG_UUCP","LOG_CRON","LOG_AUTHPRIV","LOG_FTP","LOG_LOCAL0","LOG_LOCAL1","LOG_LOCAL2","LOG_LOCAL3","LOG_LOCAL4","LOG_LOCAL5","LOG_LOCAL6","LOG_LOCAL7"]},"protocol":{"type":"string","description":"udp or tcp, udp is a safe default","enum":["udp","tcp"]},"tag":{"type":"string","description":"dot separated “application tag” that will be included in messages"},"output":{"type":"string","description":"One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)","enum":["CEE","CEF","DEFAULT"]}}},{"type":"object","required":["url"],"additionalProperties":false,"properties":{"url":{"type":"string"},"short":{"type":"boolean","description":"Display messages in a shorter style"}}},{"type":"object","required":["accountsid","authtoken","to","messagingservicesid"],"additionalProperties":false,"properties":{"accountsid":{"type":"string"},"authtoken":{"type":"string"},"to":{"type":"object","additionalProperties":false,"properties":{"number":{"type":"string"},"region":{"type":"string"}}},"messagingservicesid":{"type":"string"}}},{"type":"object","required":["url"],"additionalProperties":false,"properties":{"authpassword":{"type":"string","description":"HTTP Basic Auth password"},"authusername":{"type":"string","description":"HTTP Basic Auth ID"},"contenttype":{"type":"string"},"headers":{"type":"object","description":"Comma separated list of header:value pairs"},"skipsslverification":{"type":"boolean","description":"Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate"},"url":{"type":"string"}}}]}}}]}}}}
```
## The IntegrationsResponseBgp object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseBgp":{"type":"object","required":["expiration","community","factors","max","neighbors","nexthop"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"community":{"type":"string"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"nexthop":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}}}}}
```
## The IntegrationsResponseBlocklist object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseBlocklist":{"type":"object","required":["factors","expiration","max"],"additionalProperties":false,"properties":{"factors":{"type":"array","items":{"type":"string"}},"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"max":{"type":"integer"},"whitelist":{"type":"array","items":{"type":"string"}}}}}}}
```
## The IntegrationsResponseCrowdstrike object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseCrowdstrike":{"type":"object","required":["expiration","factors","max","url","client_id","client_secret"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"url":{"description":"Crowdstrike base API URL, can be found in your crowdstrike account","type":"string"},"client_id":{"type":"string"},"client_secret":{"type":"string"}}}}}}
```
## The IntegrationsResponseEmail object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseEmail":{"type":"object","required":["recipients","cc","bcc"],"additionalProperties":false,"properties":{"recipients":{"type":"array","items":{"type":"string"}},"cc":{"type":"array","items":{"type":"string"}},"bcc":{"type":"array","items":{"type":"string"}}}}}}}
```
## The IntegrationsResponseFlowspec object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseFlowspec":{"type":"object","required":["expiration","factors","max","neighbors"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"whitelist":{"type":"array","items":{"type":"string"}}}}}}}
```
## The IntegrationsResponseFlowspecCustom object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseFlowspecCustom":{"type":"object","required":["expiration","factors","max","neighbors","rule"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"rule":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}}}}}
```
## The IntegrationsResponseNs1 object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseNs1":{"type":"object","required":["apikey","domain","link","type","zone"],"additionalProperties":false,"properties":{"apikey":{"description":"API Key","type":"string"},"domain":{"type":"string"},"link":{"type":"string"},"type":{"type":"string","description":"Record type"},"zone":{"type":"string"}}}}}}
```
## The IntegrationsResponsePagerduty object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponsePagerduty":{"type":"object","required":["apikey","integrationkey","severity"],"additionalProperties":false,"properties":{"apikey":{"type":"string"},"integrationkey":{"type":"string"},"severity":{"type":"string"}}}}}}
```
## The IntegrationsResponseRoute53 object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseRoute53":{"type":"object","required":["accesskeyid","aliastarget","evaluatetargethealth","hostedzoneid","name","secretaccesskey","type"],"additionalProperties":false,"properties":{"accesskeyid":{"type":"string"},"aliastarget":{"type":"object"},"evaluatetargethealth":{"type":"boolean"},"hostedzoneid":{"type":"string"},"name":{"type":"string"},"secretaccesskey":{"type":"string"},"type":{"type":"string","description":"Record type"}}}}}}
```
## The IntegrationsResponseRtbh object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseRtbh":{"type":"object","required":["expiration","community","factors","max","neighbors","nexthop"],"additionalProperties":false,"properties":{"expiration":{"description":"In seconds before expiration from the blocklist","type":"integer"},"community":{"type":"string"},"factors":{"type":"array","items":{"type":"string"}},"max":{"type":"integer"},"neighbors":{"type":"array","items":{"type":"string"}},"nexthop":{"type":"string"},"whitelist":{"type":"array","items":{"type":"string"}}}}}}}
```
## The IntegrationsResponseSlack object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseSlack":{"type":"object","required":["url","channel"],"additionalProperties":false,"properties":{"url":{"type":"string"},"channel":{"type":"string"}}}}}}
```
## The IntegrationsResponseSyslog object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseSyslog":{"type":"object","required":["host","facility","protocol","tag","output"],"additionalProperties":false,"properties":{"host":{"type":"string","description":"combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port."},"facility":{"type":"string","description":"LOG_LOCAL0 is a safe default","enum":["LOG_KERN","LOG_USER","LOG_MAIL","LOG_DAEMON","LOG_AUTH","LOG_SYSLOG","LOG_LPR","LOG_NEWS","LOG_UUCP","LOG_CRON","LOG_AUTHPRIV","LOG_FTP","LOG_LOCAL0","LOG_LOCAL1","LOG_LOCAL2","LOG_LOCAL3","LOG_LOCAL4","LOG_LOCAL5","LOG_LOCAL6","LOG_LOCAL7"]},"protocol":{"type":"string","description":"udp or tcp, udp is a safe default","enum":["udp","tcp"]},"tag":{"type":"string","description":"dot separated “application tag” that will be included in messages"},"output":{"type":"string","description":"One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)","enum":["CEE","CEF","DEFAULT"]}}}}}}
```
## The IntegrationsResponseTeams object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseTeams":{"type":"object","required":["url"],"additionalProperties":false,"properties":{"url":{"type":"string"},"short":{"type":"boolean","description":"Display messages in a shorter style"}}}}}}
```
## The IntegrationsResponseTwilio object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseTwilio":{"type":"object","required":["accountsid","authtoken","to","messagingservicesid"],"additionalProperties":false,"properties":{"accountsid":{"type":"string"},"authtoken":{"type":"string"},"to":{"type":"object","additionalProperties":false,"properties":{"number":{"type":"string"},"region":{"type":"string"}}},"messagingservicesid":{"type":"string"}}}}}}
```
## The IntegrationsResponseWebhook object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IntegrationsResponseWebhook":{"type":"object","required":["url"],"additionalProperties":false,"properties":{"authpassword":{"type":"string","description":"HTTP Basic Auth password"},"authusername":{"type":"string","description":"HTTP Basic Auth ID"},"contenttype":{"type":"string"},"headers":{"type":"object","description":"Comma separated list of header:value pairs"},"skipsslverification":{"type":"boolean","description":"Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate"},"url":{"type":"string"}}}}}}
```
## The IpRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"IpRecord":{"type":"object","additionalProperties":false,"properties":{"bogon":{"description":"Is a bogon or not","type":"boolean"},"ip":{"description":"IP Address","type":"string"},"firstseen":{"description":"Timestamp of first time this ip address was seen.","type":"integer"},"lastseen":{"description":"Timestamp of last time this ip address was seen.","type":"integer"},"count":{"description":"Number of times this ip address has been seen.","type":"integer"},"iprep":{"description":"Object with ip reputation information","type":"object","additionalProperties":false,"properties":{"count":{"description":"Number of times this ip address has been seen.","type":"integer"},"categories":{"type":"array","description":"Array of geo reputation categories this ip address has been flagged in.","maxItems":1000,"items":{"type":"string"}}}},"geo":{"description":"Object with geographic location information","type":"object"},"as":{"type":"object","additionalProperties":false,"description":"ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.","properties":{"number":{"description":"AS number looked up","type":"integer"},"org":{"description":"AS Org for this AS number","type":"string"}}},"rdns":{"description":"Reverse DNS","type":"string"},"pdns":{"description":"Protective DNS","type":"object","additionalProperties":false,"properties":{"count":{"description":"Number of times this ip address has been seen.","type":"integer"},"records":{"type":"array","description":"Array of PDNS records","maxItems":1000,"items":{"type":"string"}}}}}}}}}
```
## The LabelIp object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"LabelIp":{"description":"IP Label Create Config.","type":"object","required":["ip","context","labels"],"additionalProperties":false,"properties":{"ip":{"description":"IP address","type":"string"},"context":{"description":"IP label context. default context is 'name'.","type":"string"},"labels":{"description":"Array containing the IP labels.","type":"array","minItems":1,"maxItems":10000,"items":{"type":"string"}}}}}}}
```
## The LabelIpDelete object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"LabelIpDelete":{"description":"Delete IP Labels via ip or context or both. One of ip or context is required. Both may be provided as well.","type":"object","required":["ip","context"],"additionalProperties":false,"properties":{"ip":{"description":"IP address.","type":"string"},"context":{"description":"IP label context. Default context is 'name'. Optional if ip is provided.","type":"string"}}}}}}
```
## The LabelPortConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"LabelPortConfig":{"description":"Port Label Create Config","type":"object","required":["protocol","port","labels"],"additionalProperties":false,"properties":{"protocol":{"description":"Protocol.","type":"string"},"port":{"description":"Port","type":"number"},"labels":{"description":"Labels for port","type":"array","minItems":1,"maxItems":10000,"items":{"type":"string"}}}}}}}
```
## The LabelPortDelete object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"LabelPortDelete":{"description":"Delete Port Labels via port or protocol or both. One of port or protocol is required. Both may be provided as well.","type":"object","required":["ip","context"],"additionalProperties":false,"properties":{"port":{"description":"Port. Optional if protocol is provided.","type":"number"},"protocol":{"description":"Protocol. Optional is port is provided.","type":"string"}}}}}}
```
## The LabelPortRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"LabelPortRecord":{"description":"Port Label Record","type":"object","additionalProperties":false,"properties":{"protocol":{"description":"Protocol","type":"string"},"port":{"description":"Port","type":"number"},"default":{"description":"If true, this is default (system) label","type":"boolean"},"hasdefault":{"description":"If true, this port has a default (system) label","type":"boolean"},"hide":{"description":"If true, this is hidden default (system) label","type":"boolean"},"labels":{"description":"Labels for port","type":"array","minItems":1,"maxItems":10000,"items":{"type":"string"}}}}}}}
```
## The Meta object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"Meta":{"type":"object","additionalProperties":false,"readOnly":true,"properties":{"code":{"description":"API response code. 200 ok, 400 you did something wrong. 500 we did something wrong","type":"integer","readOnly":true,"format":"int32"},"count":{"description":"Number of documents retrieved or updated.","type":"integer","readOnly":true,"format":"int32"}}}}}}
```
## The NetclassCommon object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"NetclassCommon":{"type":"object","properties":{"networks":{"type":"array","items":{"type":"string"},"description":"The list of networks in the classification."},"privatenets":{"type":"boolean","description":"Whether the classification includes private networks."},"privateasns":{"type":"boolean","description":"Whether the classification includes private ASNs."},"asns":{"type":"array","items":{"type":"string"},"description":"The list of ASNs in the classification."}}}}}}
```
## The NetclassConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"NetclassConfig":{"description":"Network Classification Create or Update Config","type":"object","allOf":[{"type":"object","properties":{"networks":{"type":"array","items":{"type":"string"},"description":"The list of networks in the classification."},"privatenets":{"type":"boolean","description":"Whether the classification includes private networks."},"privateasns":{"type":"boolean","description":"Whether the classification includes private ASNs."},"asns":{"type":"array","items":{"type":"string"},"description":"The list of ASNs in the classification."}}}],"required":["networks","privatenets"]}}}}
```
## The NetclassRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"NetclassRecord":{"description":"Network Classification Record","type":"object","allOf":[{"type":"object","properties":{"networks":{"type":"array","items":{"type":"string"},"description":"The list of networks in the classification."},"privatenets":{"type":"boolean","description":"Whether the classification includes private networks."},"privateasns":{"type":"boolean","description":"Whether the classification includes private ASNs."},"asns":{"type":"array","items":{"type":"string"},"description":"The list of ASNs in the classification."}}}],"properties":{"id":{"type":"string","description":"The unique identifier for the network classification."},"type":{"type":"string","description":"The type of network classification."}}}}}}
```
## The PermissionRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"PermissionRecord":{"type":"object","required":["resource"],"additionalProperties":false,"properties":{"resource":{"type":"string","description":"Resource Name"},"description":{"type":"string","description":"Resource description and/or mapping to portal"},"fetch":{"type":"boolean","description":"If fetch/get is an available action"},"create":{"type":"boolean","description":"If create is an available action"},"update":{"type":"boolean","description":"If update is an available action"},"delete":{"type":"boolean","description":"If delete is an available action"}}}}}}
```
## The ResponsePolicyCommon object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ResponsePolicyCommon":{"type":"object","properties":{"config":{"type":"object","properties":{"alerttypes":{"type":"array","items":{"type":"string","enum":["all","start","ongoing","end"]}},"severities":{"type":"array","items":{"type":"string","enum":["all","low","medium","high"]}},"algorithms":{"type":"array","items":{"type":"string","description":"Detection Model (algorithm) name"}},"categories":{"type":"array","items":{"type":"string","description":"Detection Category name"}},"tracks":{"type":"array","items":{"type":"string","enum":["all","dstip","flowsrcname","input","output","srcip"]}}}},"description":{"type":"string"},"name":{"type":"string"},"enabled":{"type":"boolean"},"type":{"type":"string","enum":["alert"]}}}}}}
```
## The ResponsePolicyConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ResponsePolicyConfig":{"description":"Response Policy Create or Update Config","type":"object","required":["name"],"allOf":[{"type":"object","properties":{"config":{"type":"object","properties":{"alerttypes":{"type":"array","items":{"type":"string","enum":["all","start","ongoing","end"]}},"severities":{"type":"array","items":{"type":"string","enum":["all","low","medium","high"]}},"algorithms":{"type":"array","items":{"type":"string","description":"Detection Model (algorithm) name"}},"categories":{"type":"array","items":{"type":"string","description":"Detection Category name"}},"tracks":{"type":"array","items":{"type":"string","enum":["all","dstip","flowsrcname","input","output","srcip"]}}}},"description":{"type":"string"},"name":{"type":"string"},"enabled":{"type":"boolean"},"type":{"type":"string","enum":["alert"]}}}],"properties":{"plugins":{"type":"array","items":{"type":"string","description":"Plugin ID to be used in the response policy"}}}}}}}
```
## The ResponsePolicyRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ResponsePolicyRecord":{"description":"Response Policy Record","type":"object","allOf":[{"type":"object","properties":{"config":{"type":"object","properties":{"alerttypes":{"type":"array","items":{"type":"string","enum":["all","start","ongoing","end"]}},"severities":{"type":"array","items":{"type":"string","enum":["all","low","medium","high"]}},"algorithms":{"type":"array","items":{"type":"string","description":"Detection Model (algorithm) name"}},"categories":{"type":"array","items":{"type":"string","description":"Detection Category name"}},"tracks":{"type":"array","items":{"type":"string","enum":["all","dstip","flowsrcname","input","output","srcip"]}}}},"description":{"type":"string"},"name":{"type":"string"},"enabled":{"type":"boolean"},"type":{"type":"string","enum":["alert"]}}}],"properties":{"id":{"type":"string","description":"Response Policy ID"},"plugins":{"type":"array","items":{"type":"object","properties":{"adapter":{"type":"string","description":"Plugin type to be used in the response policy"},"description":{"type":"string","description":"Plugin description to be used in the response policy"},"id":{"type":"string","description":"Plugin ID to be used in the response policy"},"name":{"type":"string","description":"Plugin name to be used in the response policy"},"type":{"type":"string","enum":["block","dns","notification","traffic"],"description":"Plugin type to be used in the response policy"}}}}}}}}}
```
## The RoleConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"RoleConfig":{"required":["name","permissions"],"additionalProperties":false,"properties":{"name":{"description":"The name of the role.","type":"string"},"description":{"description":"A user friendly description of the role.","type":"string"},"canMasquerade":{"description":"(resellers only) Whether or not the role can masquerade into sub accounts.","type":"boolean","default":false},"canSendFlow":{"description":"Whether or not the role can send NetoFlow.","type":"boolean","default":false},"permissions":{"type":"array","items":{"allOf":[{"type":"object","required":["resource"],"additionalProperties":false,"properties":{"resource":{"type":"string","description":"Resource Name"},"description":{"type":"string","description":"Resource description and/or mapping to portal"},"fetch":{"type":"boolean","description":"If fetch/get is an available action"},"create":{"type":"boolean","description":"If create is an available action"},"update":{"type":"boolean","description":"If update is an available action"},"delete":{"type":"boolean","description":"If delete is an available action"}}}]}}}}}}}
```
## The SearchConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"SearchConfig":{"type":"object","required":["start","end"],"description":"Search configuration schema for querying data. This schema defines the parameters used to filter and retrieve records from a dataset.","additionalProperties":false,"properties":{"start":{"description":"When the search should begin. Timestamp or negative number of seconds to look back.","type":"integer"},"end":{"description":"When the search should end. Timestamp, 0 for now or negative number of seconds to look back.","type":"integer"},"size":{"description":"Number of results to return. To avoid timeouts on large datasets, we recommend setting this value.","type":"integer"},"from":{"description":"Used in pagination. Combination of from + size","type":"integer"},"include":{"description":"Array of fields you want returned as part of the records. Default is ALL fields.","type":"array","items":{"type":"string"},"maxItems":100},"search":{"description":"A NQL search filter for constraining the dataset.","type":"string"}}}}}}
```
## The ThresholdAutomatonConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ThresholdAutomatonConfig":{"description":"Threshold Automaton Create or Update Config","type":"object","properties":{"algorithm":{"type":"string","description":"name of detection model"},"data_interval":{"type":"string","description":"defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to."},"data_lookback":{"type":"string","description":"determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides"},"data_window":{"type":"string","description":"defines the period of over which values are aggregated for Track By aggregates."},"disabled":{"type":"boolean","description":"disables auto-thresholding for the given automaton"},"filters":{"type":"array","items":{"type":"string"}},"force_override":{"type":"boolean","description":"optional, if set will override the default behavior preventing threshold values below the global average"},"high_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating high-severity thresholds"},"med_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating medium-severity thresholds"},"low_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating low-severity thresholds"},"strategy":{"type":"string","description":"used to determine the default threshold, either uses the maximum or average of data values."},"thresholds":{"type":"array","items":{"type":"string"}},"track_by":{"type":"array","description":"values to aggregate data on, should match parent DM track-by fields.","items":{"type":"string"}},"update_interval":{"type":"string"}}}}}}
```
## The ThresholdAutomatonPatchConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ThresholdAutomatonPatchConfig":{"description":"Threshold Automaton Record","type":"object","anyOf":[{"description":"Threshold Automaton Create or Update Config","type":"object","properties":{"algorithm":{"type":"string","description":"name of detection model"},"data_interval":{"type":"string","description":"defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to."},"data_lookback":{"type":"string","description":"determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides"},"data_window":{"type":"string","description":"defines the period of over which values are aggregated for Track By aggregates."},"disabled":{"type":"boolean","description":"disables auto-thresholding for the given automaton"},"filters":{"type":"array","items":{"type":"string"}},"force_override":{"type":"boolean","description":"optional, if set will override the default behavior preventing threshold values below the global average"},"high_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating high-severity thresholds"},"med_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating medium-severity thresholds"},"low_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating low-severity thresholds"},"strategy":{"type":"string","description":"used to determine the default threshold, either uses the maximum or average of data values."},"thresholds":{"type":"array","items":{"type":"string"}},"track_by":{"type":"array","description":"values to aggregate data on, should match parent DM track-by fields.","items":{"type":"string"}},"update_interval":{"type":"string"}}}]}}}}
```
## The ThresholdAutomatonRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ThresholdAutomatonRecord":{"description":"Threshold Automaton Record","type":"object","allOf":[{"description":"Threshold Automaton Create or Update Config","type":"object","properties":{"algorithm":{"type":"string","description":"name of detection model"},"data_interval":{"type":"string","description":"defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to."},"data_lookback":{"type":"string","description":"determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides"},"data_window":{"type":"string","description":"defines the period of over which values are aggregated for Track By aggregates."},"disabled":{"type":"boolean","description":"disables auto-thresholding for the given automaton"},"filters":{"type":"array","items":{"type":"string"}},"force_override":{"type":"boolean","description":"optional, if set will override the default behavior preventing threshold values below the global average"},"high_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating high-severity thresholds"},"med_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating medium-severity thresholds"},"low_sigma":{"type":"number","description":"optional, number of standard deviations to use when calculating low-severity thresholds"},"strategy":{"type":"string","description":"used to determine the default threshold, either uses the maximum or average of data values."},"thresholds":{"type":"array","items":{"type":"string"}},"track_by":{"type":"array","description":"values to aggregate data on, should match parent DM track-by fields.","items":{"type":"string"}},"update_interval":{"type":"string"}}}],"properties":{"customer":{"type":"string","description":"customer shortname"}}}}}}
```
## The ThresholdOverrideConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ThresholdOverrideConfig":{"description":"Threshold Override Create or Update Config","type":"object","required":["algorithm","rollupperiod","thresholds","track","updateinterval"],"allOf":[{"description":"Threshold Override Record","type":"object","properties":{"algorithm":{"type":"string"},"auto":{"type":"boolean"},"beta":{"type":"boolean"},"bypassdisplay":{"type":"boolean"},"bypassrule":{"type":"boolean"},"createdby":{"type":"string"},"default":{"type":"boolean"},"discards":{"type":"array"},"items":{"type":"string"},"ndm_score_confidence":{"type":"integer"},"ndm_score_threat":{"type":"integer"},"rollupperiod":{"type":"integer"},"sharedkey":{"type":"boolean"},"state":{"type":"string"},"thresholds":{"type":"array","items":{"type":"object","properties":{"severity":{"type":"string","enum":["low","medium","high"]},"threshold":{"type":"string"}}}},"track":{"type":"string"},"updateinterval":{"type":"integer"}}}]}}}}
```
## The ThresholdOverrideRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ThresholdOverrideRecord":{"description":"Threshold Override Record","type":"object","properties":{"algorithm":{"type":"string"},"auto":{"type":"boolean"},"beta":{"type":"boolean"},"bypassdisplay":{"type":"boolean"},"bypassrule":{"type":"boolean"},"createdby":{"type":"string"},"default":{"type":"boolean"},"discards":{"type":"array"},"items":{"type":"string"},"ndm_score_confidence":{"type":"integer"},"ndm_score_threat":{"type":"integer"},"rollupperiod":{"type":"integer"},"sharedkey":{"type":"boolean"},"state":{"type":"string"},"thresholds":{"type":"array","items":{"type":"object","properties":{"severity":{"type":"string","enum":["low","medium","high"]},"threshold":{"type":"string"}}}},"track":{"type":"string"},"updateinterval":{"type":"integer"}}}}}}
```
## The ThresholdTrackValue object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"ThresholdTrackValue":{"description":"Threshold Automaton Create or Update Config","type":"object","properties":{"average":{"type":"number","description":"average value for operation"},"deviation":{"type":"number"},"operation":{"type":"string"},"threshold":{"type":"array","description":"array holding values for each configured severity level for the data point.","items":{"type":"object","properties":{"level":{"type":"string"},"value":{"type":"number"}}}},"customer":{"type":"string","description":"Netography customer shortname"},"group":{"type":"string","description":"the specific track (group) the data corresponds to."},"algorithm":{"type":"string","description":"the detection model the threshold values are derived from"},"timestamp":{"type":"number","description":"unix timestamp describing when the threshold values were generated"}}}}}}
```
## The TimeseriesSeries object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"TimeseriesSeries":{"type":"object","description":"Configuration for a time series data query that defines how to aggregate and analyze network traffic data over time. Each series specifies the metric to measure, fields to group by, time intervals, and filtering criteria to generate meaningful analytics insights.","required":["name","metric","size","field"],"additionalProperties":false,"properties":{"name":{"type":"string","description":"Series name. All series in a query must have a unique name. This is how you will locate them in the response."},"field":{"type":"array","items":{"type":"string"},"description":"Field name(s) to aggregate (split) on. See Analytics > Fields for more information.","maxItems":7},"field_separator":{"type":"string","default":".","description":"when multiple fields are provided in the request, the separator is used to join the two fields in the `label` and `name` keys in the response"},"interval":{"type":"integer","description":"Time interval to group the data. If not provided the interval will be calculated based on start/end times. The greater the window the larger the interval."},"ipagg":{"type":"object","required":["cidr","field"],"additionalProperties":false,"properties":{"cidr":{"type":"integer","description":"CIDR to aggregate on. 8, 16, 32"},"field":{"type":"string","description":"Field to aggregate the CIDR on. For flow and block valid fields are `srcip` and `dstip`. For alert the valid field is `ipinfo.ip`"}}},"metric":{"type":"string","description":"metric to aggregate on. See Metrics for available values."},"search":{"type":"array","maxItems":1,"description":"A NQL search filter for constraining the dataset.","items":{"type":"string"}},"size":{"type":"integer","minimum":1,"maximum":10000,"description":"The \"Top N\" number of series to limit this query to. Not required for cardinality.","format":"int32"},"sort":{"type":"string","description":"Buckets returned ascending (asc) or descending (desc).","default":"asc"}}}}}}
```
## The TrafficDetectionModelCommon object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"TrafficDetectionModelCommon":{"type":"object","properties":{"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the detection model","type":"array","items":{"type":"string"}},"description":{"description":"Detection model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the detection model is enabled","type":"boolean"},"factors":{"description":"Factors for the detection model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the detection model","type":"string"},"rollupperiod":{"description":"The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the detection model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the detection model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the detection model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the detection model","type":"string","enum":["flow","dns"]}}}}}}
```
## The TrafficDetectionModelConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"TrafficDetectionModelConfig":{"description":"Traffic Detection Model Create or Update Config","type":"object","required":["categories","description","name","rollupperiod","search_by","thresholds","track_by","algo_record_type"],"allOf":[{"type":"object","properties":{"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the detection model","type":"array","items":{"type":"string"}},"description":{"description":"Detection model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the detection model is enabled","type":"boolean"},"factors":{"description":"Factors for the detection model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the detection model","type":"string"},"rollupperiod":{"description":"The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the detection model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the detection model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the detection model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the detection model","type":"string","enum":["flow","dns"]}}}]}}}}
```
## The TrafficDetectionModelRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"TrafficDetectionModelRecord":{"description":"Traffic Detection Model Record","type":"object","allOf":[{"type":"object","properties":{"bypassdisplay":{"description":"If true, portal and API will not display new events","type":"boolean"},"bypassrule":{"description":"If true, alerts will not be processed by policies and integrations","type":"boolean"},"categories":{"description":"Categories for the detection model","type":"array","items":{"type":"string"}},"description":{"description":"Detection model description","type":"string"},"discards":{"description":"Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model","type":"array","items":{"type":"string"}},"enabled":{"description":"If true, the detection model is enabled","type":"boolean"},"factors":{"description":"Factors for the detection model","type":"array","items":{"type":"string"}},"name":{"description":"Name of the detection model","type":"string"},"rollupperiod":{"description":"The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)","type":"integer"},"search_by":{"description":"Search criteria for the detection model","type":"array","items":{"type":"object","properties":{"search":{"type":"array","items":{"type":"string"}},"type":{"type":"string"}}}},"thresholds":{"description":"Thresholds for the detection model","type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"threshold":{"type":"string"}}}},"track_by":{"description":"Tracking criteria for the detection model","type":"array","items":{"type":"array","items":{"type":"string"}}},"updateinterval":{"description":"When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled","type":"integer"},"algo_record_type":{"description":"The context of record to be used for the detection model","type":"string","enum":["flow","dns"]}}}],"properties":{"algo_type":{"description":"Detection model type","type":"string"},"beta":{"description":"If true, it's a beta detection model","type":"boolean"},"created":{"description":"The time at which record was created","type":"integer"},"id":{"description":"Detection model ID","type":"string"},"recommended":{"description":"If true, it's a recomended detection model","type":"boolean"},"subscription":{"description":"Subscription for the detection model","type":"object","properties":{"all":{"type":"string"}}},"subscriptiontype":{"description":"Subscription type for the detection model","type":"string"},"system":{"description":"If true, it's a system detection model","type":"boolean"},"systemdefault":{"description":"If true, it's a system default detection model","type":"boolean"},"updated":{"description":"The time at which record was was last updated","type":"integer"}}}}}}
```
## The UserConfig object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"UserConfig":{"required":["given_name","family_name","email","roles"],"additionalProperties":false,"properties":{"given_name":{"description":"First or Given name of the user","type":"string"},"family_name":{"description":"Last or Family name of the user","type":"string"},"email":{"description":"User's email. This is the main identifier and cannot be changed.","type":"string"},"nickname":{"description":"User's nickname. Optional"},"picture":{"description":"HTTPS URL to a user's profile picture. Optional"},"roles":{"type":"array","items":{"type":"string"},"description":"An array containing strings which include the role name the user should be assigned to."}}}}}}
```
## The VpcConfigAwsKinesis object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"VpcConfigAwsKinesis":{"description":"AWS Kinesis Parameters.","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","region","shardid","stream","awsauthtype"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["aws"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["kinesis"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"shardid":{"type":"string","description":"Kinesis shard id"},"stream":{"description":"Kinesis stream","type":"string"},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}}}}}}}
```
## The VpcConfigAwsS3 object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"VpcConfigAwsS3":{"description":"AWS S3 Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","bucket","bucketregion","region","awsauthtype"],"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["aws"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["s3"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow","dns"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"bucket":{"type":"string","description":"S3 bucket"},"bucketregion":{"type":"string","description":"Region this S3 bucket is in."},"hive":{"type":"string","description":"S3 Hive-compatible prefix"},"prefix":{"type":"string","description":"S3 flow log path prefix"},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"sqsurl":{"type":"string","description":"SQS URL of S3 events"},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}},"awsauthtype":{"description":"The method of authentication to use with AWS. Valid options are:
AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.RoleARN indicates that role auth. The role object is then required.AccessKey auth type.","type":"string"},"accesssecret":{"description":"AWS Access secret. Required for AccessKey auth type.","type":"string"},"role":{"description":"object containing role authentication data. Required for RoleARN auth type.","type":"object","properties":{"arn":{"description":"ARN used to authenticate the flow source","type":"string"}}},"vpcid":{"description":"VPC ID of the source, applicable and required only for dns traffictype","type":"string"}}}}}}
```
## The VpcConfigAzureBlobstorage object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"VpcConfigAzureBlobstorage":{"description":"Azure Blobstorage Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","region","accountname","accountkey","containername","networksecuritygroup","resourcegroup","subscriptionid"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["azure"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["blobstorage"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"accountname":{"type":"string","description":"Azure Storage Account's Access Name"},"accountkey":{"type":"string","description":"Azure Storage Account's Access Key"},"containername":{"type":"string","description":"Azure Storage Account's Container Name"},"networksecuritygroup":{"type":"string","description":"Azure Network Security Group's Name"},"resourcegroup":{"type":"string","description":"Azure Network Security Group's Resource Group"},"subscriptionid":{"type":"string","description":"Azure Network Security Group's subscription ID"},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}}}}}}}
```
## The VpcConfigAzureVnetBlobstorage object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"VpcConfigAzureVnetBlobstorage":{"description":"Azure VNet Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","region","accountname","accountkey","containername","networkwatcher","resourcegroup","subscriptionid","flowlog"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["azure-vnet"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["blobstorage"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow"]},"name":{"description":"The name of this flow source in Netography Fusion. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"Enable or disable polling the cloud provider for samples","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"Virtual Network Region in Azure region format (lowercase with no spaces). Examples: eastus, centralus, westus2. See Get VPC regions by flowtype for a list of valid regions.\n"},"accountname":{"type":"string","description":"Azure Storage Account Name where flow logs are stored"},"accountkey":{"type":"string","description":"Azure Storage Account's Access Key"},"containername":{"type":"string","description":"Azure Storage Account's Container Name. Use default of insights-logs-flowlogflowevent. Do not include leading spaces in the value.\n"},"networkwatcher":{"type":"string","description":"Azure Network Watcher's Name. Usually in format NetworkWatcher_region (e.g. NetworkWatcher_eastus).\n"},"resourcegroup":{"type":"string","description":"Azure Network Watcher's Resource Group. Use default of NETWORKWATCHERRG. Do not change unless you know what you're doing.\n"},"flowlog":{"type":"string","description":"Flow Log Name as shown in Network Watcher in Azure. This is a required field that identifies the specific flow log to collect.\n"},"subscriptionid":{"type":"string","description":"Network Watcher Subscription ID"},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}}}}}}}
```
## The VpcConfigGcp object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"VpcConfigGcp":{"description":"GCP PubSub Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","projectid","subid"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["gcp"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["pubsub"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow","dns"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"projectid":{"type":"string","description":"GCP Project ID"},"subid":{"type":"string","description":"GCP PubSub Subscription ID"},"samplepercent":{"description":"Sample Rate Percent","type":"integer","format":"int32","minimum":1,"maximum":100},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}}}}}}}
```
## The VpcConfigIbmObjectstorage object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"VpcConfigIbmObjectstorage":{"description":"IBM Objectstorage Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","region","apikey","bucket","serviceinstanceid"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["ibm"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["objectstorage"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"apikey":{"type":"string","description":"IBM Objectstorage API key that is associated for the Service ID."},"bucket":{"type":"string","description":"The Objectstorage bucket name."},"prefix":{"type":"string","description":"Flow log path prefix"},"serviceinstanceid":{"type":"string","description":"Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential."},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}}}}}}}
```
## The VpcConfigOracleObjectstorage object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"VpcConfigOracleObjectstorage":{"description":"Oracle Objectstorage Parameters","type":"object","required":["flowtype","flowresource","name","enabled","samplerate","region","bucket","tenancy","userid"],"additionalProperties":false,"properties":{"flowtype":{"description":"The VPC's flowtype","type":"string","enum":["oracle"]},"flowresource":{"description":"The VPC's resource used to transmit flow events.","type":"string","enum":["objectstorage"]},"traffictype":{"description":"The VPC's traffic type. Can't be changed at updating.","type":"string","enum":["flow"]},"name":{"description":"The name of the VPC. Eg. prod-vpc-east","type":"string"},"enabled":{"description":"If this VPC is enabled or disabled.","type":"boolean"},"samplerate":{"description":"The samplerate of flows this VPC will send. Between 1 and 65535.","type":"integer","format":"int32","minimum":1,"maximum":65535},"region":{"type":"string","description":"The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n"},"bucket":{"type":"string","description":"The Oracle Objectstorage bucket name."},"tenancy":{"type":"string","description":"Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID)."},"userid":{"type":"string","description":"Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID)."},"prefix":{"type":"string","description":"Optional folder prefix"},"tags":{"description":"An array of strings to tag every flow from this VPC with.","type":"array","items":{"type":"string"}}}}}}}
```
## The DNSDeviceRecord object
```json
{"openapi":"3.0.0","info":{"title":"Netography APIs","version":"1.0"},"components":{"schemas":{"DNSDeviceRecord":{"type":"object","description":"Response schema for a single DNS device.","properties":{"id":{"type":"string","description":"Unique identifier for the DNS device."},"name":{"type":"string","description":"Name of the DNS device."},"type":{"type":"string","description":"Type of the DNS device."},"site":{"type":"string","description":"Site location of the DNS device."},"enabled":{"type":"boolean","description":"Whether the DNS device is enabled."}},"required":["id","name","type","site","enabled"]}}}}
```