Class GetFindingsRequestParameters

Request options for GetFindings

<p>https://docs.opensearch.org/latest/security-analytics/api-tools/alert-finding-api/#get-findings</p>
Inheritance
object
RequestParameters<GetFindingsRequestParameters>
GetFindingsRequestParameters
Implements
Inherited Members
Namespace: OpenSearch.Net.Specification.SecurityAnalyticsApi
Assembly: OpenSearch.Net.dll
Syntax
public class GetFindingsRequestParameters : RequestParameters<GetFindingsRequestParameters>, IRequestParameters

Properties

| Edit this page View Source

DefaultHttpMethod

Declaration
public override HttpMethod DefaultHttpMethod { get; }
Property Value
Type Description
HttpMethod
Overrides
| Edit this page View Source

DetectionType

The detection type that dictates the retrieval type for the findings. When the detection type is threat, it fetches threat intelligence feeds. When the detection type is rule, findings are fetched based on the detector’s rule. Optional.

Declaration
public SecurityAnalyticsFindingsDetectionType? DetectionType { get; set; }
Property Value
Type Description
SecurityAnalyticsFindingsDetectionType?
| Edit this page View Source

DetectorId

The ID of the detector used to fetch alerts. Optional when the detectorType is specified. Otherwise required.

Declaration
public string DetectorId { get; set; }
Property Value
Type Description
string
| Edit this page View Source

DetectorType

The type of detector used to fetch alerts. Optional when the detector_id is specified. Otherwise required.

Declaration
public string DetectorType { get; set; }
Property Value
Type Description
string
| Edit this page View Source

EndTime

The end timestamp (in ms) of the time window in which you want to retrieve findings. Optional.

Declaration
public string EndTime { get; set; }
Property Value
Type Description
string
| Edit this page View Source

FindingIds

The comma-separated id list of findings for which you want retrieve details. Optional.

Declaration
public string FindingIds { get; set; }
Property Value
Type Description
string
| Edit this page View Source

Missing

Used to sort by whether the field missing exists or not in the documents associated with the finding. Optional.

Declaration
public string Missing { get; set; }
Property Value
Type Description
string
| Edit this page View Source

OperationName

The OpenSearch REST API operation name this request maps to (for example search or indices.create), used as the OpenTelemetry span name and db.operation tag. null for requests that do not correspond to a named API operation.

Declaration
public override string OperationName { get; }
Property Value
Type Description
string
Overrides
| Edit this page View Source

SearchString

The finding attribute you want returned in the search. To search in a specific index, specify the index name in the request path. For example, to search findings in the indexABC index, use `searchString=indexABC’. Optional.

Declaration
public string SearchString { get; set; }
Property Value
Type Description
string
| Edit this page View Source

Severity

The rule severity for which retrieve findings. Severity can be critical, high, medium, or low. Optional.

Declaration
public SecurityAnalyticsFindingsRuleSeverity? Severity { get; set; }
Property Value
Type Description
SecurityAnalyticsFindingsRuleSeverity?
| Edit this page View Source

Size

The maximum number of results returned in the response. Optional.

Declaration
public long? Size { get; set; }
Property Value
Type Description
long?
| Edit this page View Source

SortOrder

The order used to sort the list of findings. Possible values are asc or desc. Optional.

Declaration
public SortOrder? SortOrder { get; set; }
Property Value
Type Description
SortOrder?
| Edit this page View Source

SortString

The string used by the Alerting plugin to sort the findings. Optional.

Declaration
public string SortString { get; set; }
Property Value
Type Description
string
| Edit this page View Source

StartIndex

The pagination index. Optional.

Declaration
public long? StartIndex { get; set; }
Property Value
Type Description
long?
| Edit this page View Source

StartTime

The beginning timestamp (in ms) of the time window in which you want to retrieve findings. Optional.

Declaration
public long? StartTime { get; set; }
Property Value
Type Description
long?
| Edit this page View Source

SupportsBody

Declaration
public override bool SupportsBody { get; }
Property Value
Type Description
bool
Overrides

Implements

Extension Methods