{"docsConfig":{"theme":"linden","$schema":"https://mintlify.com/docs.json","name":"Cotool Documentation","colors":{"primary":"#A9D5F5","light":"#A9D5F5","dark":"#ADB7C2"},"logo":{"light":"https://mintcdn.com/cotool-bcb49c92/2D7q2Y6FoJjh0OqV/logo/light.svg?fit=max\u0026auto=format\u0026n=2D7q2Y6FoJjh0OqV\u0026q=85\u0026s=ed5fa6ba5fadea78cb6d1341380b9873","dark":"https://mintcdn.com/cotool-bcb49c92/2D7q2Y6FoJjh0OqV/logo/dark.svg?fit=max\u0026auto=format\u0026n=2D7q2Y6FoJjh0OqV\u0026q=85\u0026s=fab6122c7e0ad6a1e8299f49397231f5"},"favicon":"https://mintcdn.com/cotool-bcb49c92/YkFCFtl3swKv9Xqp/favicon.png?fit=max\u0026auto=format\u0026n=YkFCFtl3swKv9Xqp\u0026q=85\u0026s=4c02ec1d53713897f1c2b6f7815e864b","api":{"playground":{"display":"simple"},"examples":{"defaults":"all","languages":["curl","python","javascript","java","go"]}},"navbar":{"links":[{"href":"mailto:support@cotool.ai","label":"Support"}]},"footer":{"socials":{"x":"https://x.com/cotoolai","linkedin":"https://www.linkedin.com/company/cotool-ai","website":"https://cotool.ai"}},"integrations":{"ga4":{"measurementId":"G-RJSB18V7N5"},"gtm":{"tagId":"GTM-5BPJH7T2"}},"contextual":{"options":["copy","view"],"display":"header"},"styling":{"latex":false},"background":{"color":{"light":"#fcfeff","dark":"#0e0f12"}},"navigation":{"global":{"anchors":[{"anchor":"Blog","icon":"newspaper","href":"https://cotool.ai/blog"}]},"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"cotool-bcb49c92","hasAudioNarration":false,"actualSubdomain":"cotool-bcb49c92","customDomains":["docs.cotool.ai"],"gitSource":{"type":"github","owner":"cotool","repo":"cogent-client","deployBranch":"stable","contentDirectory":"docs","isPrivate":true,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6adab817df07ff0fca84f17c","collectionId":"7dd0535e-fe12-400e-a93e-2a525722422c","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6adab817df07ff0fca84f17c"},"feedback":{"thumbs":true},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6adb8e72858a516f4e16fc1e","clientVersion":"0.0.3966","searchFilterCounts":[{"language":"default","tag":"API Reference","count":151},{"language":"default","tag":"Endpoints","count":150},{"language":"default","tag":"Documentation","count":58},{"language":"default","tag":"Agents","count":28},{"language":"default","tag":"Alerts","count":19},{"language":"default","tag":"Integrations","count":17},{"language":"default","tag":"Agent Runs","count":14},{"language":"default","tag":"Hunt","count":12},{"language":"default","tag":"Agent Triggers","count":12},{"language":"default","tag":"Intel","count":11}]},"assistantConfig":{},"hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-v7-file-tree","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"pause-universal-search-reconcile","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"per-site-search-delta","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-private-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-nav-generations","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-agent-model-picker","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"isAtlas":false,"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"api-reference/hunt/restore-a-dismissed-threat","slug":"/api-reference/hunt/restore-a-dismissed-threat","pageMetadata":{"title":"Restore a dismissed Threat","description":"Clear an explicit dismissal, returning the Threat to its derived status.","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/threats/{id}/restore","href":"/api-reference/hunt/restore-a-dismissed-threat","autogeneratedByOpenApi":true},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Clear an explicit dismissal, returning the Threat to its derived status.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Restore a dismissed Threat","description":"Clear an explicit dismissal, returning the Threat to its derived status.","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/threats/{id}/restore","href":"/api-reference/hunt/restore-a-dismissed-threat","autogeneratedByOpenApi":true}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":[],"openApiReferenceData":{"operation":{"summary":"Restore a dismissed Threat","description":"Clear an explicit dismissal, returning the Threat to its derived status.","tags":["Hunt"],"x-codeSamples":[{"lang":"shell","label":"cURL","source":"curl -X POST \"https://app.cotool.ai/api/threats/:id/restore\" \\\n -H \"Authorization: Bearer YOUR_API_KEY\" \\\n -H \"Content-Type: application/json\""}],"parameters":["54b4c949-d5d5-473c-aab8-d75b5d475879"],"responses":{"200":"dc6a0845-81b8-4b39-be58-92d8dd5d36e3","400":"4c8b20a1-3789-4215-b1e3-b5b69defe2c1","401":"85c34e1f-e677-4fab-b128-7cb8569749c0","403":"08cd5a90-4f9a-4cdd-b72e-25963457bb36","500":"9cd3eaed-f259-4a4e-b847-0bc18d4d8e3b"},"method":"post","type":"path","servers":["f12402bf-094d-4e8f-a6cd-e74cf07b2abe"],"security":["e618135f-d82c-4c86-a175-8e63ddc0cbf3"],"path":"/api/threats/{id}/restore","baseUrlOptions":["https://app.cotool.ai"],"title":"Restore a dismissed Threat","codeSamples":[{"label":"cURL","lang":"shell","source":"curl -X POST \"https://app.cotool.ai/api/threats/:id/restore\" \\\n -H \"Authorization: Bearer YOUR_API_KEY\" \\\n -H \"Content-Type: application/json\""}],"requestExampleLanguages":["bash","python","javascript","java","go"],"requiredOnlyExamples":false,"requestExampleType":"codeSamples","responseExampleType":"generated"},"dependencies":{"parameters":{"54b4c949-d5d5-473c-aab8-d75b5d475879":{"in":"path","name":"id","schema":{"type":"string","isRequired":true,"uniqueKey":"","typeLabel":"string"},"required":true}},"responses":{"dc6a0845-81b8-4b39-be58-92d8dd5d36e3":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"threat":{"type":"object","properties":{"id":{"type":"string","isRequired":true,"uniqueKey":"threat.id","typeLabel":"string"},"organizationId":{"type":"string","isRequired":true,"uniqueKey":"threat.organizationId","typeLabel":"string"},"canonicalType":{"type":"string","enum":["vulnerability","campaign"],"isRequired":true,"uniqueKey":"threat.canonicalType","typeLabel":"enum\u003cstring>"},"canonicalKeyType":{"type":"string","enum":["cve","advisory","vendor_advisory","campaign_name","malware_family"],"isRequired":true,"uniqueKey":"threat.canonicalKeyType","typeLabel":"enum\u003cstring>"},"canonicalKey":{"type":"string","isRequired":true,"uniqueKey":"threat.canonicalKey","typeLabel":"string"},"title":{"type":"string","isRequired":true,"uniqueKey":"threat.title","typeLabel":"string"},"aliases":{"type":"array","items":{"type":"string","uniqueKey":"threat.aliases.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"threat.aliases","typeLabel":"string[]"},"actorId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"threat.actorId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"threat.actorId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.actorId","typeLabel":"string | null"},"intelItemIds":{"type":"array","items":{"type":"string","uniqueKey":"threat.intelItemIds.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"threat.intelItemIds","typeLabel":"string[]"},"relevancyScore":{"oneOf":[{"type":"number","isRequired":true,"uniqueKey":"threat.relevancyScore.oneOf.0","typeLabel":"number"},{"type":"null","isRequired":true,"uniqueKey":"threat.relevancyScore.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.relevancyScore","typeLabel":"number | null"},"exposureScore":{"oneOf":[{"type":"number","isRequired":true,"uniqueKey":"threat.exposureScore.oneOf.0","typeLabel":"number"},{"type":"null","isRequired":true,"uniqueKey":"threat.exposureScore.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.exposureScore","typeLabel":"number | null"},"exposureState":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null],"isRequired":true,"uniqueKey":"threat.exposureState.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null],"isRequired":true,"uniqueKey":"threat.exposureState.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.exposureState","typeLabel":"enum\u003cstring> | null"},"coverageState":{"oneOf":[{"type":"string","enum":["none","partial","covered","unknown",null],"isRequired":true,"uniqueKey":"threat.coverageState.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["none","partial","covered","unknown",null],"isRequired":true,"uniqueKey":"threat.coverageState.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.coverageState","typeLabel":"enum\u003cstring> | null"},"detectionEngineeringNote":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"threat.detectionEngineeringNote.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"threat.detectionEngineeringNote.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.detectionEngineeringNote","typeLabel":"string | null"},"latestRunId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"threat.latestRunId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"threat.latestRunId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.latestRunId","typeLabel":"string | null"},"assessmentRunningExecutionId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"threat.assessmentRunningExecutionId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"threat.assessmentRunningExecutionId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.assessmentRunningExecutionId","typeLabel":"string | null"},"assessmentFailedAt":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"threat.assessmentFailedAt.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"threat.assessmentFailedAt.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.assessmentFailedAt","typeLabel":"string | null"},"latestAlertId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"threat.latestAlertId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"threat.latestAlertId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.latestAlertId","typeLabel":"string | null"},"activeHuntAlertId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"threat.activeHuntAlertId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"threat.activeHuntAlertId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.activeHuntAlertId","typeLabel":"string | null"},"dismissedAt":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"threat.dismissedAt.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"threat.dismissedAt.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.dismissedAt","typeLabel":"string | null"},"dismissedByUserId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"threat.dismissedByUserId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"threat.dismissedByUserId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.dismissedByUserId","typeLabel":"string | null"},"dismissedReason":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"threat.dismissedReason.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"threat.dismissedReason.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"threat.dismissedReason","typeLabel":"string | null"},"createdAt":{"type":"string","isRequired":true,"uniqueKey":"threat.createdAt","typeLabel":"string"},"updatedAt":{"type":"string","isRequired":true,"uniqueKey":"threat.updatedAt","typeLabel":"string"}},"required":["id","organizationId","canonicalType","canonicalKeyType","canonicalKey","title","aliases","actorId","intelItemIds","relevancyScore","exposureScore","exposureState","coverageState","detectionEngineeringNote","latestRunId","assessmentRunningExecutionId","assessmentFailedAt","latestAlertId","activeHuntAlertId","dismissedAt","dismissedByUserId","dismissedReason","createdAt","updatedAt"],"isRequired":true,"uniqueKey":"threat","typeLabel":"object"},"runs":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].id","typeLabel":"string"},"threatId":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].threatId","typeLabel":"string"},"kind":{"type":"string","enum":["create","update"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].kind","typeLabel":"enum\u003cstring>"},"trigger":{"type":"string","enum":["new_threat","intel_attached","manual","backfill","reclassification"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].trigger","typeLabel":"enum\u003cstring>"},"runAt":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].runAt","typeLabel":"string"},"relevancyExecutionId":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].relevancyExecutionId","typeLabel":"string"},"relevancyScore":{"type":"number","isRequired":true,"uniqueKey":"runs.items.[INDEX].relevancyScore","typeLabel":"number"},"relevancyExplanation":{"type":"array","items":{"type":"string","uniqueKey":"runs.items.[INDEX].relevancyExplanation.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].relevancyExplanation","typeLabel":"string[]"},"exposureExecutionId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureExecutionId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureExecutionId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureExecutionId","typeLabel":"string | null"},"exposureScore":{"oneOf":[{"type":"number","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureScore.oneOf.0","typeLabel":"number"},{"type":"null","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureScore.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureScore","typeLabel":"number | null"},"exposureState":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureState.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureState.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureState","typeLabel":"enum\u003cstring> | null"},"exposureStory":{"oneOf":[{"type":"object","properties":{"exposureState":{"type":"string","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureState","typeLabel":"enum\u003cstring>"},"summary":{"type":"array","items":{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.summary.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.summary","typeLabel":"string[]"},"exposureChecks":{"type":"array","items":{"type":"object","properties":{"purpose":{"type":"string","enum":["exposure","ioc","telemetry","detection_coverage"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].purpose","typeLabel":"enum\u003cstring>"},"checked":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].checked","typeLabel":"string"},"source":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].source","typeLabel":"string"},"scope":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].scope","typeLabel":"string"},"timeWindow":{"oneOf":[{"type":"object","properties":{"start":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].timeWindow.oneOf.0.start","typeLabel":"string"},"end":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].timeWindow.oneOf.0.end","typeLabel":"string"}},"required":["start","end"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].timeWindow.oneOf.0","typeLabel":"object"},{"type":"null","properties":{"start":{"type":"string"},"end":{"type":"string"}},"required":["start","end"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].timeWindow.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].timeWindow","typeLabel":"object | null"},"outcome":{"type":"string","enum":["found","not_found","inconclusive"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].outcome","typeLabel":"enum\u003cstring>"},"evidence":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].evidence","typeLabel":"string"},"limitations":{"type":"array","items":{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].limitations.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].limitations","typeLabel":"string[]"},"indicatorId":{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].indicatorId","typeLabel":"string"},"authoritative":{"type":"boolean","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].authoritative","typeLabel":"boolean"},"iocType":{"type":"string","enum":["ip","domain","url","hash","file_path","process","registry_key","certificate","cloud_id","package","email","user_agent","mutex","other"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].iocType","typeLabel":"enum\u003cstring>"},"indicatorRole":{"type":"string","enum":["compromise","relevance"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX].indicatorRole","typeLabel":"enum\u003cstring>"}},"required":["purpose","checked","source","scope","timeWindow","outcome","evidence","limitations"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.exposureChecks","typeLabel":"object[]"},"assets":{"type":"array","items":{"type":"object","properties":{"identifier":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX].identifier","typeLabel":"string"},"kind":{"type":"string","enum":["repository","host","service","cloud_resource","identity","package","domain","saas_account","container_image","other"],"default":"other","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX].kind","typeLabel":"enum\u003cstring>"},"platform":{"oneOf":[{"type":"string","default":null,"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX].platform.oneOf.0","typeLabel":"string"},{"type":"null","default":null,"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX].platform.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX].platform","typeLabel":"string | null"},"source":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX].source","typeLabel":"string"},"internetFacing":{"oneOf":[{"type":"boolean","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX].internetFacing.oneOf.0","typeLabel":"boolean"},{"type":"null","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX].internetFacing.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX].internetFacing","typeLabel":"boolean | null"},"evidence":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX].evidence","typeLabel":"string"}},"required":["identifier","kind","platform","source","internetFacing","evidence"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.assets","typeLabel":"object[]"},"iocFindings":{"type":"array","items":{"type":"object","properties":{"iocType":{"type":"string","enum":["ip","domain","url","hash","file_path","process","registry_key","certificate","cloud_id","package","email","user_agent","mutex","other"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].iocType","typeLabel":"enum\u003cstring>"},"role":{"type":"string","enum":["compromise","relevance"],"default":"compromise","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].role","typeLabel":"enum\u003cstring>"},"platform":{"oneOf":[{"type":"string","default":null,"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].platform.oneOf.0","typeLabel":"string"},{"type":"null","default":null,"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].platform.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].platform","typeLabel":"string | null"},"iocValue":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].iocValue","typeLabel":"string"},"evidence":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].evidence","typeLabel":"string"},"affectedSystems":{"type":"array","items":{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].affectedSystems.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].affectedSystems","typeLabel":"string[]"},"indicatorId":{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].indicatorId","typeLabel":"string"},"authoritative":{"type":"boolean","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX].authoritative","typeLabel":"boolean"}},"required":["iocType","role","platform","iocValue","evidence","affectedSystems"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.iocFindings","typeLabel":"object[]"},"detectionCoverage":{"type":"object","properties":{"state":{"type":"string","enum":["none","partial","covered","unknown"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.state","typeLabel":"enum\u003cstring>"},"searches":{"type":"array","items":{"type":"object","properties":{"source":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.searches.items.[INDEX].source","typeLabel":"string"},"criteria":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.searches.items.[INDEX].criteria","typeLabel":"string"},"resultCount":{"type":"number","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.searches.items.[INDEX].resultCount","typeLabel":"number"},"evidence":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.searches.items.[INDEX].evidence","typeLabel":"string"},"limitations":{"type":"array","items":{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.searches.items.[INDEX].limitations.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.searches.items.[INDEX].limitations","typeLabel":"string[]"}},"required":["source","criteria","resultCount","evidence","limitations"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.searches.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.searches","typeLabel":"object[]"},"matches":{"type":"array","items":{"type":"object","properties":{"ref":{"type":"object","properties":{"id":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].ref.id","typeLabel":"string"},"name":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].ref.name","typeLabel":"string"},"kind":{"type":"string","enum":["rule_proposal","deployed_rule","detection_agent"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].ref.kind","typeLabel":"enum\u003cstring>"},"platform":{"oneOf":[{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].ref.platform.oneOf.0","typeLabel":"string"},{"type":"null","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].ref.platform.oneOf.1","typeLabel":"null"}],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].ref.platform","typeLabel":"string | null"},"url":{"oneOf":[{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].ref.url.oneOf.0","typeLabel":"string"},{"type":"null","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].ref.url.oneOf.1","typeLabel":"null"}],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].ref.url","typeLabel":"string | null"}},"required":["id","name","kind"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].ref","typeLabel":"object"},"coverage":{"type":"string","enum":["partial","covered","unknown"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].coverage","typeLabel":"enum\u003cstring>"},"rationale":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].rationale","typeLabel":"string"},"limitations":{"type":"array","items":{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].limitations.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX].limitations","typeLabel":"string[]"}},"required":["ref","coverage","rationale","limitations"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage.matches","typeLabel":"object[]"}},"required":["state","searches","matches"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.detectionCoverage","typeLabel":"object"},"gaps":{"type":"array","items":{"type":"object","properties":{"product":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].product","typeLabel":"string"},"logSource":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].logSource","typeLabel":"string"},"scopeType":{"type":"string","enum":["org","integration","account","environment","asset_group","tenant","domain"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].scopeType","typeLabel":"enum\u003cstring>"},"scopeId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].scopeId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].scopeId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].scopeId","typeLabel":"string | null"},"scopeKey":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].scopeKey","typeLabel":"string"},"blocking":{"type":"boolean","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].blocking","typeLabel":"boolean"},"description":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].description","typeLabel":"string"},"limitations":{"type":"array","items":{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].limitations.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX].limitations","typeLabel":"string[]"}},"required":["product","logSource","scopeType","scopeId","scopeKey","blocking","description","limitations"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.gaps","typeLabel":"object[]"},"nextSteps":{"type":"array","items":{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.nextSteps.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.nextSteps","typeLabel":"string[]"},"executionId":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.executionId","typeLabel":"string"},"runAt":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.runAt","typeLabel":"string"},"headline":{"type":"string","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.headline","typeLabel":"string"},"discoveredIndicators":{"type":"array","items":{"type":"object","properties":{"indicatorId":{"type":"string","minLength":1,"description":"Unique run-local id such as discovered-1.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.discoveredIndicators.items.[INDEX].indicatorId","typeLabel":"string"},"iocType":{"type":"string","enum":["ip","domain","url","hash","file_path","process","registry_key","certificate","cloud_id","package","email","user_agent","mutex","other"],"description":"Canonical indicator type.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.discoveredIndicators.items.[INDEX].iocType","typeLabel":"enum\u003cstring>"},"role":{"type":"string","enum":["compromise","relevance"],"description":"Required role with no default.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.discoveredIndicators.items.[INDEX].role","typeLabel":"enum\u003cstring>"},"iocValue":{"type":"string","minLength":1,"maxLength":2048,"description":"One exact atomic indicator value, never a prose/composite description.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.discoveredIndicators.items.[INDEX].iocValue","typeLabel":"string"},"roleRationale":{"type":"string","minLength":1,"description":"Why a match alone does or does not justify a compromise claim.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.discoveredIndicators.items.[INDEX].roleRationale","typeLabel":"string"},"evidence":{"type":"string","minLength":1,"description":"Cited evidence establishing this as a threat indicator.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.discoveredIndicators.items.[INDEX].evidence","typeLabel":"string"},"platform":{"type":"string","description":"Optional registry/ecosystem for package or image indicators.","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.discoveredIndicators.items.[INDEX].platform","typeLabel":"string"}},"required":["indicatorId","iocType","role","iocValue","roleRationale","evidence"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.discoveredIndicators.items.[INDEX]","typeLabel":"object"},"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.discoveredIndicators","typeLabel":"object[]"},"observations":{"type":"array","items":{"type":"object","properties":{"observationId":{"type":"string","minLength":1,"description":"Unique run-local observation id.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations.items.[INDEX].observationId","typeLabel":"string"},"kind":{"type":"string","enum":["software_presence","vulnerable_asset","configuration_exposure","exploit_attempt","suspicious_behavior","confirmed_malicious_behavior"],"description":"Semantic kind of customer-environment observation.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations.items.[INDEX].kind","typeLabel":"enum\u003cstring>"},"summary":{"type":"string","minLength":1,"description":"Concise statement of what was observed.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations.items.[INDEX].summary","typeLabel":"string"},"evidence":{"type":"string","minLength":1,"description":"Cited customer-environment evidence.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations.items.[INDEX].evidence","typeLabel":"string"},"affectedSystems":{"type":"array","items":{"type":"string","description":"Affected system identifier.","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations.items.[INDEX].affectedSystems.items.[INDEX]","typeLabel":"string"},"description":"Affected customer assets; empty when none.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations.items.[INDEX].affectedSystems","typeLabel":"string[]"},"timeWindow":{"type":"object","properties":{"start":{"type":"string","description":"Observation window start.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations.items.[INDEX].timeWindow.start","typeLabel":"string"},"end":{"type":"string","description":"Observation window end.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations.items.[INDEX].timeWindow.end","typeLabel":"string"}},"required":["start","end"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations.items.[INDEX].timeWindow","typeLabel":"object"}},"required":["observationId","kind","summary","evidence","affectedSystems"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations.items.[INDEX]","typeLabel":"object"},"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.observations","typeLabel":"object[]"},"researchContext":{"type":"array","items":{"type":"object","properties":{"contextId":{"type":"string","minLength":1,"description":"Unique run-local context id.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.researchContext.items.[INDEX].contextId","typeLabel":"string"},"summary":{"type":"string","minLength":1,"description":"Concise public/intel fact.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.researchContext.items.[INDEX].summary","typeLabel":"string"},"evidence":{"type":"string","minLength":1,"description":"Cited evidence for the context fact.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.researchContext.items.[INDEX].evidence","typeLabel":"string"}},"required":["contextId","summary","evidence"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.researchContext.items.[INDEX]","typeLabel":"object"},"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.researchContext","typeLabel":"object[]"},"conclusion":{"type":"object","properties":{"headline":{"type":"string","minLength":1,"description":"One self-contained sentence stating the environment verdict and the evidence-based interpretation that determines the score. Never merely report that an indicator matched: if activity is attributable to security inspection, scanning, testing, or another evidenced benign cause, state both the match and that interpretation so the reader immediately understands why it is not concerning. When the exposure score is in the residual band (35-59), state the residual condition — what concretely remains exposed, unpatched, or unverified — never a bare \"no exposure found\".","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.conclusion.headline","typeLabel":"string"},"summary":{"type":"array","items":{"type":"string","description":"One concise cited verdict bullet.","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.conclusion.summary.items.[INDEX]","typeLabel":"string"},"minItems":3,"maxItems":8,"description":"3-8 concise bullets explaining the environment verdict.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.conclusion.summary","typeLabel":"string[]"},"supportingFindingIds":{"type":"array","items":{"type":"string","description":"An input-catalog indicatorId that appears in indicatorChecks, or an observationId defined in observations, copied verbatim.","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.conclusion.supportingFindingIds.items.[INDEX]","typeLabel":"string"},"description":"Authoritative input-check or environment-observation ids supporting the verdict, copied verbatim from ids defined in this output; never discovered-indicator ids, context ids, or invented shorthand ids.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.conclusion.supportingFindingIds","typeLabel":"string[]"},"contextIds":{"type":"array","items":{"type":"string","description":"Research context id used for interpretation.","uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.conclusion.contextIds.items.[INDEX]","typeLabel":"string"},"description":"Referenced public/intel context ids.","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.conclusion.contextIds","typeLabel":"string[]"}},"required":["headline","summary","supportingFindingIds","contextIds"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.conclusion","typeLabel":"object"},"timeline":{"type":"array","items":{"type":"object","properties":{"timestamp":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.timeline.items.[INDEX].timestamp","typeLabel":"string"},"description":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.timeline.items.[INDEX].description","typeLabel":"string"}},"required":["timestamp","description"],"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.timeline.items.[INDEX]","typeLabel":"object"},"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0.timeline","typeLabel":"object[]"}},"required":["exposureState","summary","exposureChecks","assets","iocFindings","detectionCoverage","gaps","nextSteps","executionId","runAt"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.0","typeLabel":"object"},{"type":"null","properties":{"exposureState":{"type":"string","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive"]},"headline":{"type":"string"},"summary":{"type":"array","items":{"type":"string"}},"exposureChecks":{"type":"array","items":{"type":"object","properties":{"purpose":{"type":"string","enum":["exposure","ioc","telemetry","detection_coverage"]},"indicatorId":{"type":"string"},"authoritative":{"type":"boolean"},"iocType":{"type":"string","enum":["ip","domain","url","hash","file_path","process","registry_key","certificate","cloud_id","package","email","user_agent","mutex","other"]},"indicatorRole":{"type":"string","enum":["compromise","relevance"]},"checked":{"type":"string"},"source":{"type":"string"},"scope":{"type":"string"},"timeWindow":{"oneOf":[{"type":"object","properties":{"start":{"type":"string"},"end":{"type":"string"}},"required":["start","end"]},{"type":"null","properties":{"start":{"type":"string"},"end":{"type":"string"}},"required":["start","end"]}]},"outcome":{"type":"string","enum":["found","not_found","inconclusive"]},"evidence":{"type":"string"},"limitations":{"type":"array","items":{"type":"string"}}},"required":["purpose","checked","source","scope","timeWindow","outcome","evidence","limitations"]}},"assets":{"type":"array","items":{"type":"object","properties":{"identifier":{"type":"string"},"kind":{"type":"string","enum":["repository","host","service","cloud_resource","identity","package","domain","saas_account","container_image","other"],"default":"other"},"platform":{"oneOf":[{"type":"string","default":null},{"type":"null","default":null}]},"source":{"type":"string"},"internetFacing":{"oneOf":[{"type":"boolean"},{"type":"null"}]},"evidence":{"type":"string"}},"required":["identifier","kind","platform","source","internetFacing","evidence"]}},"iocFindings":{"type":"array","items":{"type":"object","properties":{"indicatorId":{"type":"string"},"authoritative":{"type":"boolean"},"iocType":{"type":"string","enum":["ip","domain","url","hash","file_path","process","registry_key","certificate","cloud_id","package","email","user_agent","mutex","other"]},"role":{"type":"string","enum":["compromise","relevance"],"default":"compromise"},"platform":{"oneOf":[{"type":"string","default":null},{"type":"null","default":null}]},"iocValue":{"type":"string"},"evidence":{"type":"string"},"affectedSystems":{"type":"array","items":{"type":"string"}}},"required":["iocType","role","platform","iocValue","evidence","affectedSystems"]}},"discoveredIndicators":{"type":"array","items":{"type":"object","properties":{"indicatorId":{"type":"string","minLength":1,"description":"Unique run-local id such as discovered-1."},"iocType":{"type":"string","enum":["ip","domain","url","hash","file_path","process","registry_key","certificate","cloud_id","package","email","user_agent","mutex","other"],"description":"Canonical indicator type."},"role":{"type":"string","enum":["compromise","relevance"],"description":"Required role with no default."},"platform":{"type":"string","description":"Optional registry/ecosystem for package or image indicators."},"iocValue":{"type":"string","minLength":1,"maxLength":2048,"description":"One exact atomic indicator value, never a prose/composite description."},"roleRationale":{"type":"string","minLength":1,"description":"Why a match alone does or does not justify a compromise claim."},"evidence":{"type":"string","minLength":1,"description":"Cited evidence establishing this as a threat indicator."}},"required":["indicatorId","iocType","role","iocValue","roleRationale","evidence"]}},"observations":{"type":"array","items":{"type":"object","properties":{"observationId":{"type":"string","minLength":1,"description":"Unique run-local observation id."},"kind":{"type":"string","enum":["software_presence","vulnerable_asset","configuration_exposure","exploit_attempt","suspicious_behavior","confirmed_malicious_behavior"],"description":"Semantic kind of customer-environment observation."},"summary":{"type":"string","minLength":1,"description":"Concise statement of what was observed."},"evidence":{"type":"string","minLength":1,"description":"Cited customer-environment evidence."},"affectedSystems":{"type":"array","items":{"type":"string","description":"Affected system identifier."},"description":"Affected customer assets; empty when none."},"timeWindow":{"type":"object","properties":{"start":{"type":"string","description":"Observation window start."},"end":{"type":"string","description":"Observation window end."}},"required":["start","end"]}},"required":["observationId","kind","summary","evidence","affectedSystems"]}},"researchContext":{"type":"array","items":{"type":"object","properties":{"contextId":{"type":"string","minLength":1,"description":"Unique run-local context id."},"summary":{"type":"string","minLength":1,"description":"Concise public/intel fact."},"evidence":{"type":"string","minLength":1,"description":"Cited evidence for the context fact."}},"required":["contextId","summary","evidence"]}},"conclusion":{"type":"object","properties":{"headline":{"type":"string","minLength":1,"description":"One self-contained sentence stating the environment verdict and the evidence-based interpretation that determines the score. Never merely report that an indicator matched: if activity is attributable to security inspection, scanning, testing, or another evidenced benign cause, state both the match and that interpretation so the reader immediately understands why it is not concerning. When the exposure score is in the residual band (35-59), state the residual condition — what concretely remains exposed, unpatched, or unverified — never a bare \"no exposure found\"."},"summary":{"type":"array","items":{"type":"string","description":"One concise cited verdict bullet."},"minItems":3,"maxItems":8,"description":"3-8 concise bullets explaining the environment verdict."},"supportingFindingIds":{"type":"array","items":{"type":"string","description":"An input-catalog indicatorId that appears in indicatorChecks, or an observationId defined in observations, copied verbatim."},"description":"Authoritative input-check or environment-observation ids supporting the verdict, copied verbatim from ids defined in this output; never discovered-indicator ids, context ids, or invented shorthand ids."},"contextIds":{"type":"array","items":{"type":"string","description":"Research context id used for interpretation."},"description":"Referenced public/intel context ids."}},"required":["headline","summary","supportingFindingIds","contextIds"]},"detectionCoverage":{"type":"object","properties":{"state":{"type":"string","enum":["none","partial","covered","unknown"]},"searches":{"type":"array","items":{"type":"object","properties":{"source":{"type":"string"},"criteria":{"type":"string"},"resultCount":{"type":"number"},"evidence":{"type":"string"},"limitations":{"type":"array","items":{"type":"string"}}},"required":["source","criteria","resultCount","evidence","limitations"]}},"matches":{"type":"array","items":{"type":"object","properties":{"ref":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"kind":{"type":"string","enum":["rule_proposal","deployed_rule","detection_agent"]},"platform":{"oneOf":[{"type":"string"},{"type":"null"}]},"url":{"oneOf":[{"type":"string"},{"type":"null"}]}},"required":["id","name","kind"]},"coverage":{"type":"string","enum":["partial","covered","unknown"]},"rationale":{"type":"string"},"limitations":{"type":"array","items":{"type":"string"}}},"required":["ref","coverage","rationale","limitations"]}}},"required":["state","searches","matches"]},"gaps":{"type":"array","items":{"type":"object","properties":{"product":{"type":"string"},"logSource":{"type":"string"},"scopeType":{"type":"string","enum":["org","integration","account","environment","asset_group","tenant","domain"]},"scopeId":{"oneOf":[{"type":"string"},{"type":"null"}]},"scopeKey":{"type":"string"},"blocking":{"type":"boolean"},"description":{"type":"string"},"limitations":{"type":"array","items":{"type":"string"}}},"required":["product","logSource","scopeType","scopeId","scopeKey","blocking","description","limitations"]}},"nextSteps":{"type":"array","items":{"type":"string"}},"timeline":{"type":"array","items":{"type":"object","properties":{"timestamp":{"type":"string"},"description":{"type":"string"}},"required":["timestamp","description"]}},"executionId":{"type":"string"},"runAt":{"type":"string"}},"required":["exposureState","summary","exposureChecks","assets","iocFindings","detectionCoverage","gaps","nextSteps","executionId","runAt"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].exposureStory","typeLabel":"object | null"},"coverageState":{"oneOf":[{"type":"string","enum":["none","partial","covered","unknown",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].coverageState.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["none","partial","covered","unknown",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].coverageState.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].coverageState","typeLabel":"enum\u003cstring> | null"},"hasFoundIoc":{"type":"boolean","isRequired":true,"uniqueKey":"runs.items.[INDEX].hasFoundIoc","typeLabel":"boolean"},"hasBlockingGap":{"type":"boolean","isRequired":true,"uniqueKey":"runs.items.[INDEX].hasBlockingGap","typeLabel":"boolean"},"diff":{"oneOf":[{"type":"object","properties":{"prevRunId":{"type":"string","isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.prevRunId","typeLabel":"string"},"beforeExposureScore":{"oneOf":[{"type":"number","isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.beforeExposureScore.oneOf.0","typeLabel":"number"},{"type":"null","isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.beforeExposureScore.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.beforeExposureScore","typeLabel":"number | null"},"afterExposureScore":{"oneOf":[{"type":"number","isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.afterExposureScore.oneOf.0","typeLabel":"number"},{"type":"null","isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.afterExposureScore.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.afterExposureScore","typeLabel":"number | null"},"beforeExposureState":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.beforeExposureState.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.beforeExposureState.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.beforeExposureState","typeLabel":"enum\u003cstring> | null"},"afterExposureState":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.afterExposureState.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.afterExposureState.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.afterExposureState","typeLabel":"enum\u003cstring> | null"},"beforeCoverageState":{"oneOf":[{"type":"string","enum":["none","partial","covered","unknown",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.beforeCoverageState.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["none","partial","covered","unknown",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.beforeCoverageState.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.beforeCoverageState","typeLabel":"enum\u003cstring> | null"},"afterCoverageState":{"oneOf":[{"type":"string","enum":["none","partial","covered","unknown",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.afterCoverageState.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["none","partial","covered","unknown",null],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.afterCoverageState.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.afterCoverageState","typeLabel":"enum\u003cstring> | null"},"reasons":{"type":"array","items":{"type":"string","uniqueKey":"runs.items.[INDEX].diff.oneOf.0.reasons.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0.reasons","typeLabel":"string[]"}},"required":["prevRunId","beforeExposureScore","afterExposureScore","beforeExposureState","afterExposureState","beforeCoverageState","afterCoverageState","reasons"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.0","typeLabel":"object"},{"type":"null","properties":{"prevRunId":{"type":"string"},"beforeExposureScore":{"oneOf":[{"type":"number"},{"type":"null"}]},"afterExposureScore":{"oneOf":[{"type":"number"},{"type":"null"}]},"beforeExposureState":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null]},{"type":"null","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null]}]},"afterExposureState":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null]},{"type":"null","enum":["compromise_signal_found","exposure_found","no_exposure_found","inconclusive",null]}]},"beforeCoverageState":{"oneOf":[{"type":"string","enum":["none","partial","covered","unknown",null]},{"type":"null","enum":["none","partial","covered","unknown",null]}]},"afterCoverageState":{"oneOf":[{"type":"string","enum":["none","partial","covered","unknown",null]},{"type":"null","enum":["none","partial","covered","unknown",null]}]},"reasons":{"type":"array","items":{"type":"string"}}},"required":["prevRunId","beforeExposureScore","afterExposureScore","beforeExposureState","afterExposureState","beforeCoverageState","afterCoverageState","reasons"],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"runs.items.[INDEX].diff","typeLabel":"object | null"},"relevancyHeadline":{"oneOf":[{"type":"string","uniqueKey":"runs.items.[INDEX].relevancyHeadline.oneOf.0","typeLabel":"string"},{"type":"null","uniqueKey":"runs.items.[INDEX].relevancyHeadline.oneOf.1","typeLabel":"null"}],"uniqueKey":"runs.items.[INDEX].relevancyHeadline","typeLabel":"string | null"}},"required":["id","threatId","kind","trigger","runAt","relevancyExecutionId","relevancyScore","relevancyExplanation","exposureExecutionId","exposureScore","exposureState","exposureStory","coverageState","hasFoundIoc","hasBlockingGap","diff"],"uniqueKey":"runs.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"runs","typeLabel":"object[]"},"deliverables":{"type":"array","items":{"oneOf":[{"type":"object","required":["id","organizationId","threatId","executionId","createdAt","supersededById","kind","proposalId","pullRequestUrl","intent","pinning","pinnedIocs","targetProduct","targetLogSource","lifecycleStatus"],"properties":{"id":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.id","typeLabel":"string"},"organizationId":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.organizationId","typeLabel":"string"},"threatId":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.threatId","typeLabel":"string"},"executionId":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.executionId","typeLabel":"string"},"createdAt":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.createdAt","typeLabel":"string"},"supersededById":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.supersededById.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.supersededById.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.supersededById","typeLabel":"string | null"},"kind":{"type":"string","const":"rule_proposal","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.kind","typeLabel":"string"},"proposalId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.proposalId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.proposalId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.proposalId","typeLabel":"string | null"},"pullRequestUrl":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.pullRequestUrl.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.pullRequestUrl.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.pullRequestUrl","typeLabel":"string | null"},"intent":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.intent","typeLabel":"string"},"pinning":{"type":"string","enum":["ioc_pinned","behavioral","mixed"],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.pinning","typeLabel":"enum\u003cstring>"},"pinnedIocs":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.pinnedIocs.items.[INDEX].type","typeLabel":"string"},"value":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.pinnedIocs.items.[INDEX].value","typeLabel":"string"}},"required":["type","value"],"uniqueKey":"deliverables.items.[INDEX].oneOf.0.pinnedIocs.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.pinnedIocs","typeLabel":"object[]"},"targetProduct":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.targetProduct.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.targetProduct.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.targetProduct","typeLabel":"string | null"},"targetLogSource":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.targetLogSource.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.targetLogSource.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.targetLogSource","typeLabel":"string | null"},"lifecycleStatus":{"type":"string","enum":["authoring","drafted","in_review","shipped","dismissed","failed"],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.0.lifecycleStatus","typeLabel":"enum\u003cstring>"}},"uniqueKey":"deliverables.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","required":["id","organizationId","threatId","executionId","createdAt","supersededById","kind","product","logSource","scopeType","scopeId","scopeKey","blocking","description","gapStatus","establishedAt","statusAt","statusActor","statusReason"],"properties":{"id":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.id","typeLabel":"string"},"organizationId":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.organizationId","typeLabel":"string"},"threatId":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.threatId","typeLabel":"string"},"executionId":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.executionId","typeLabel":"string"},"createdAt":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.createdAt","typeLabel":"string"},"supersededById":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.supersededById.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.supersededById.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.supersededById","typeLabel":"string | null"},"kind":{"type":"string","const":"gap","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.kind","typeLabel":"string"},"product":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.product","typeLabel":"string"},"logSource":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.logSource","typeLabel":"string"},"scopeType":{"type":"string","enum":["org","integration","account","environment","asset_group","tenant","domain"],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.scopeType","typeLabel":"enum\u003cstring>"},"scopeId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.scopeId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.scopeId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.scopeId","typeLabel":"string | null"},"scopeKey":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.scopeKey","typeLabel":"string"},"blocking":{"type":"boolean","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.blocking","typeLabel":"boolean"},"description":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.description","typeLabel":"string"},"gapStatus":{"type":"string","enum":["open","resolved","dismissed"],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.gapStatus","typeLabel":"enum\u003cstring>"},"establishedAt":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.establishedAt","typeLabel":"string"},"statusAt":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusAt.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusAt.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusAt","typeLabel":"string | null"},"statusActor":{"oneOf":[{"type":"object","required":["type","runId"],"properties":{"type":{"type":"string","const":"agent","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusActor.oneOf.0.type","typeLabel":"string"},"runId":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusActor.oneOf.0.runId","typeLabel":"string"}},"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusActor.oneOf.0","typeLabel":"object"},{"type":"object","required":["type","userId"],"properties":{"type":{"type":"string","const":"human","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusActor.oneOf.1.type","typeLabel":"string"},"userId":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusActor.oneOf.1.userId","typeLabel":"string"}},"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusActor.oneOf.1","typeLabel":"object"},{"type":"null","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusActor.oneOf.2","typeLabel":"null"}],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusActor","typeLabel":"object · object · null"},"statusReason":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusReason.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusReason.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.statusReason","typeLabel":"string | null"},"gapId":{"oneOf":[{"type":"string","uniqueKey":"deliverables.items.[INDEX].oneOf.1.gapId.oneOf.0","typeLabel":"string"},{"type":"null","uniqueKey":"deliverables.items.[INDEX].oneOf.1.gapId.oneOf.1","typeLabel":"null"}],"uniqueKey":"deliverables.items.[INDEX].oneOf.1.gapId","typeLabel":"string | null"},"otherLinkedThreats":{"type":"array","items":{"type":"object","properties":{"threatId":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.otherLinkedThreats.items.[INDEX].threatId","typeLabel":"string"},"threatTitle":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.otherLinkedThreats.items.[INDEX].threatTitle","typeLabel":"string"},"canonicalKey":{"type":"string","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.otherLinkedThreats.items.[INDEX].canonicalKey","typeLabel":"string"},"blocking":{"type":"boolean","isRequired":true,"uniqueKey":"deliverables.items.[INDEX].oneOf.1.otherLinkedThreats.items.[INDEX].blocking","typeLabel":"boolean"}},"required":["threatId","threatTitle","canonicalKey","blocking"],"uniqueKey":"deliverables.items.[INDEX].oneOf.1.otherLinkedThreats.items.[INDEX]","typeLabel":"object"},"uniqueKey":"deliverables.items.[INDEX].oneOf.1.otherLinkedThreats","typeLabel":"object[]"}},"uniqueKey":"deliverables.items.[INDEX].oneOf.1","typeLabel":"object"}],"uniqueKey":"deliverables.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"deliverables","typeLabel":"object[]"},"intelItems":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].id","typeLabel":"string"},"title":{"type":"string","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].title","typeLabel":"string"},"publisher":{"type":"string","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].publisher","typeLabel":"string"},"url":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].url.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].url.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"intelItems.items.[INDEX].url","typeLabel":"string | null"},"publishedAt":{"type":"string","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].publishedAt","typeLabel":"string"},"tldr":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].tldr.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].tldr.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"intelItems.items.[INDEX].tldr","typeLabel":"string | null"},"attackPath":{"type":"array","items":{"type":"string","uniqueKey":"intelItems.items.[INDEX].attackPath.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"intelItems.items.[INDEX].attackPath","typeLabel":"string[]"},"sourceName":{"oneOf":[{"type":"string","uniqueKey":"intelItems.items.[INDEX].sourceName.oneOf.0","typeLabel":"string"},{"type":"null","uniqueKey":"intelItems.items.[INDEX].sourceName.oneOf.1","typeLabel":"null"}],"uniqueKey":"intelItems.items.[INDEX].sourceName","typeLabel":"string | null"},"summary":{"oneOf":[{"type":"string","uniqueKey":"intelItems.items.[INDEX].summary.oneOf.0","typeLabel":"string"},{"type":"null","uniqueKey":"intelItems.items.[INDEX].summary.oneOf.1","typeLabel":"null"}],"uniqueKey":"intelItems.items.[INDEX].summary","typeLabel":"string | null"},"attackTechniques":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].attackTechniques.items.[INDEX].id","typeLabel":"string"},"name":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].attackTechniques.items.[INDEX].name.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].attackTechniques.items.[INDEX].name.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"intelItems.items.[INDEX].attackTechniques.items.[INDEX].name","typeLabel":"string | null"}},"required":["id","name"],"uniqueKey":"intelItems.items.[INDEX].attackTechniques.items.[INDEX]","typeLabel":"object"},"uniqueKey":"intelItems.items.[INDEX].attackTechniques","typeLabel":"object[]"},"malware":{"type":"array","items":{"type":"string","uniqueKey":"intelItems.items.[INDEX].malware.items.[INDEX]","typeLabel":"string"},"uniqueKey":"intelItems.items.[INDEX].malware","typeLabel":"string[]"},"actors":{"type":"array","items":{"type":"string","uniqueKey":"intelItems.items.[INDEX].actors.items.[INDEX]","typeLabel":"string"},"uniqueKey":"intelItems.items.[INDEX].actors","typeLabel":"string[]"},"platforms":{"type":"array","items":{"type":"string","uniqueKey":"intelItems.items.[INDEX].platforms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"intelItems.items.[INDEX].platforms","typeLabel":"string[]"},"affectedProducts":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","isRequired":true,"uniqueKey":"intelItems.items.[INDEX].affectedProducts.items.[INDEX].name","typeLabel":"string"},"versions":{"type":"array","items":{"type":"string","uniqueKey":"intelItems.items.[INDEX].affectedProducts.items.[INDEX].versions.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"intelItems.items.[INDEX].affectedProducts.items.[INDEX].versions","typeLabel":"string[]"}},"required":["name","versions"],"uniqueKey":"intelItems.items.[INDEX].affectedProducts.items.[INDEX]","typeLabel":"object"},"uniqueKey":"intelItems.items.[INDEX].affectedProducts","typeLabel":"object[]"},"eventFirstSeen":{"oneOf":[{"type":"string","uniqueKey":"intelItems.items.[INDEX].eventFirstSeen.oneOf.0","typeLabel":"string"},{"type":"null","uniqueKey":"intelItems.items.[INDEX].eventFirstSeen.oneOf.1","typeLabel":"null"}],"uniqueKey":"intelItems.items.[INDEX].eventFirstSeen","typeLabel":"string | null"},"eventLastSeen":{"oneOf":[{"type":"string","uniqueKey":"intelItems.items.[INDEX].eventLastSeen.oneOf.0","typeLabel":"string"},{"type":"null","uniqueKey":"intelItems.items.[INDEX].eventLastSeen.oneOf.1","typeLabel":"null"}],"uniqueKey":"intelItems.items.[INDEX].eventLastSeen","typeLabel":"string | null"}},"required":["id","title","publisher","url","publishedAt","tldr","attackPath"],"uniqueKey":"intelItems.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"intelItems","typeLabel":"object[]"},"alerts":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Internal alert identifier","isRequired":true,"uniqueKey":"alerts.items.[INDEX].id","typeLabel":"string\u003cuuid>"},"displayId":{"type":"string","pattern":"^COT-\\d+$","description":"Human-readable alert identifier","isRequired":true,"uniqueKey":"alerts.items.[INDEX].displayId","typeLabel":"string"},"organizationId":{"type":"string","format":"uuid","description":"Organization that owns the alert","isRequired":true,"uniqueKey":"alerts.items.[INDEX].organizationId","typeLabel":"string\u003cuuid>"},"organizationName":{"type":"string","minLength":1,"description":"URL-safe organization name used in durable alert paths","isRequired":true,"uniqueKey":"alerts.items.[INDEX].organizationName","typeLabel":"string"},"title":{"type":"string","minLength":1,"description":"Human-readable alert title","isRequired":true,"uniqueKey":"alerts.items.[INDEX].title","typeLabel":"string"},"description":{"oneOf":[{"type":"string","description":"Markdown summary or details for the alert","isRequired":true,"uniqueKey":"alerts.items.[INDEX].description.oneOf.0","typeLabel":"string"},{"type":"null","description":"Markdown summary or details for the alert","isRequired":true,"uniqueKey":"alerts.items.[INDEX].description.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].description","typeLabel":"string | null"},"severity":{"oneOf":[{"type":"string","enum":["low","medium","high","critical",null],"description":"Alert severity when known","isRequired":true,"uniqueKey":"alerts.items.[INDEX].severity.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["low","medium","high","critical",null],"description":"Alert severity when known","isRequired":true,"uniqueKey":"alerts.items.[INDEX].severity.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].severity","typeLabel":"enum\u003cstring> | null"},"status":{"type":"string","enum":["open","in_progress","escalated","closed_true_positive","closed_false_positive","closed_true_positive_benign","dismissed","duplicate","expired"],"description":"Lifecycle status for a first-class alert. Terminal closed statuses include final disposition. Dismissed, duplicate, and expired alerts are archived and hidden from alert lists.","isRequired":true,"uniqueKey":"alerts.items.[INDEX].status","typeLabel":"enum\u003cstring>"},"duplicateCount":{"type":"integer","minimum":0,"description":"Number of alerts archived as duplicates of this alert. A high count means the same finding keeps recurring.","isRequired":true,"uniqueKey":"alerts.items.[INDEX].duplicateCount","typeLabel":"integer"},"source":{"type":"object","properties":{"category":{"type":"string","enum":["detection","trigger","hunt","api","agent"],"description":"Broad alert source category. Hunt covers threat-intel exposure alerts minted by the Hunt surface; api covers alerts submitted through an API source; agent covers alerts deliberately created by an agent.","isRequired":true,"uniqueKey":"alerts.items.[INDEX].source.category","typeLabel":"enum\u003cstring>"},"name":{"type":"string","enum":["cotool_detection","cotool_code","hunt","api","agent","jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon"],"description":"Filter-oriented alert source name. Trigger-created alerts use the trigger type.","isRequired":true,"uniqueKey":"alerts.items.[INDEX].source.name","typeLabel":"enum\u003cstring>"},"triggerType":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source when category is trigger","isRequired":true,"uniqueKey":"alerts.items.[INDEX].source.triggerType.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source when category is trigger","isRequired":true,"uniqueKey":"alerts.items.[INDEX].source.triggerType.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].source.triggerType","typeLabel":"enum\u003cstring> | null"}},"required":["category","name","triggerType"],"description":"Filter-oriented source attribution for an alert.","isRequired":true,"uniqueKey":"alerts.items.[INDEX].source","typeLabel":"object"},"detection":{"oneOf":[{"type":"object","properties":{"id":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection identifier when known","isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.id.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Cotool detection identifier when known","isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.id.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.id","typeLabel":"string\u003cuuid> | null"},"agentId":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection agent identifier when known","isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.agentId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Cotool detection agent identifier when known","isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.agentId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.agentId","typeLabel":"string\u003cuuid> | null"},"ruleId":{"oneOf":[{"type":"string","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule","isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.ruleId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule","isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.ruleId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.ruleId","typeLabel":"string\u003cuuid> | null"},"name":{"type":"string","minLength":1,"description":"Detection display name","isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.name","typeLabel":"string"},"kind":{"type":"string","enum":["cotool","cotool_code","external"],"description":"Whether this detection attribution is internal or extracted","isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.kind","typeLabel":"enum\u003cstring>"},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection identifier when this alert came from Code Mode","uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.codeDetectionId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Code detection identifier when this alert came from Code Mode","uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.codeDetectionId.oneOf.1","typeLabel":"null"}],"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.codeDetectionId","typeLabel":"string\u003cuuid> | null"},"origin":{"oneOf":[{"type":"string","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature.","uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.origin.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature.","uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.origin.oneOf.1","typeLabel":"null"}],"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0.origin","typeLabel":"enum\u003cstring> | null"}},"required":["id","agentId","ruleId","name","kind"],"description":"Detection attribution for the alert, when known.","isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.0","typeLabel":"object"},{"type":"null","properties":{"id":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection identifier when known"}]},"agentId":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection agent identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection agent identifier when known"}]},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"},{"type":"null","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"}]},"ruleId":{"oneOf":[{"type":"string","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"},{"type":"null","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"}]},"name":{"type":"string","minLength":1,"description":"Detection display name"},"kind":{"type":"string","enum":["cotool","cotool_code","external"],"description":"Whether this detection attribution is internal or extracted"},"origin":{"oneOf":[{"type":"string","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."},{"type":"null","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."}]}},"required":["id","agentId","ruleId","name","kind"],"description":"Detection attribution for the alert, when known.","isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].detection","typeLabel":"object | null"},"createdBy":{"type":"string","enum":["agent","trigger","system"],"description":"Actor class that created the alert.","isRequired":true,"uniqueKey":"alerts.items.[INDEX].createdBy","typeLabel":"enum\u003cstring>"},"originAgentId":{"oneOf":[{"type":"string","format":"uuid","description":"Agent that produced or owns the source flow","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originAgentId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Agent that produced or owns the source flow","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originAgentId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].originAgentId","typeLabel":"string\u003cuuid> | null"},"originTriggerId":{"oneOf":[{"type":"string","format":"uuid","description":"Trigger that created this alert, when source is an external trigger","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originTriggerId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Trigger that created this alert, when source is an external trigger","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originTriggerId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].originTriggerId","typeLabel":"string\u003cuuid> | null"},"originRunId":{"oneOf":[{"type":"string","format":"uuid","description":"Run that minted the alert, stored as chats.id","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originRunId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Run that minted the alert, stored as chats.id","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originRunId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].originRunId","typeLabel":"string\u003cuuid> | null"},"originDetectionHitId":{"oneOf":[{"type":"string","format":"uuid","description":"Detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originDetectionHitId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originDetectionHitId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].originDetectionHitId","typeLabel":"string\u003cuuid> | null"},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection that produced this alert, when applicable","isRequired":true,"uniqueKey":"alerts.items.[INDEX].codeDetectionId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Code detection that produced this alert, when applicable","isRequired":true,"uniqueKey":"alerts.items.[INDEX].codeDetectionId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].codeDetectionId","typeLabel":"string\u003cuuid> | null"},"originCodeDetectionHitId":{"oneOf":[{"type":"string","format":"uuid","description":"Code-detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originCodeDetectionHitId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Code-detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originCodeDetectionHitId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].originCodeDetectionHitId","typeLabel":"string\u003cuuid> | null"},"externalProvider":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"External trigger provider such as jira, linear, email, or webhook","isRequired":true,"uniqueKey":"alerts.items.[INDEX].externalProvider.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"External trigger provider such as jira, linear, email, or webhook","isRequired":true,"uniqueKey":"alerts.items.[INDEX].externalProvider.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].externalProvider","typeLabel":"enum\u003cstring> | null"},"externalRef":{"oneOf":[{"type":"string","description":"Provider-native event, ticket, message, or alert identifier","isRequired":true,"uniqueKey":"alerts.items.[INDEX].externalRef.oneOf.0","typeLabel":"string"},{"type":"null","description":"Provider-native event, ticket, message, or alert identifier","isRequired":true,"uniqueKey":"alerts.items.[INDEX].externalRef.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].externalRef","typeLabel":"string | null"},"externalUrl":{"oneOf":[{"type":"string","format":"uri","description":"Provider-native URL for the originating object","isRequired":true,"uniqueKey":"alerts.items.[INDEX].externalUrl.oneOf.0","typeLabel":"string\u003curi>"},{"type":"null","format":"uri","description":"Provider-native URL for the originating object","isRequired":true,"uniqueKey":"alerts.items.[INDEX].externalUrl.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].externalUrl","typeLabel":"string\u003curi> | null"},"assignedAgentId":{"oneOf":[{"type":"string","format":"uuid","description":"Response agent currently assigned to triage this alert","isRequired":true,"uniqueKey":"alerts.items.[INDEX].assignedAgentId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Response agent currently assigned to triage this alert","isRequired":true,"uniqueKey":"alerts.items.[INDEX].assignedAgentId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].assignedAgentId","typeLabel":"string\u003cuuid> | null"},"triageRunId":{"oneOf":[{"type":"string","format":"uuid","description":"Latest response-agent triage run for this alert, stored as chats.id","isRequired":true,"uniqueKey":"alerts.items.[INDEX].triageRunId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Latest response-agent triage run for this alert, stored as chats.id","isRequired":true,"uniqueKey":"alerts.items.[INDEX].triageRunId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].triageRunId","typeLabel":"string\u003cuuid> | null"},"dedupeKey":{"oneOf":[{"type":"string","description":"Stable key used for idempotent alert creation","isRequired":true,"uniqueKey":"alerts.items.[INDEX].dedupeKey.oneOf.0","typeLabel":"string"},{"type":"null","description":"Stable key used for idempotent alert creation","isRequired":true,"uniqueKey":"alerts.items.[INDEX].dedupeKey.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].dedupeKey","typeLabel":"string | null"},"createdAt":{"type":"string","description":"ISO timestamp when the alert was created","isRequired":true,"uniqueKey":"alerts.items.[INDEX].createdAt","typeLabel":"string"},"updatedAt":{"type":"string","description":"ISO timestamp when the alert was last updated","isRequired":true,"uniqueKey":"alerts.items.[INDEX].updatedAt","typeLabel":"string"},"firstTriagedAt":{"oneOf":[{"type":"string","description":"ISO timestamp when triage first started","isRequired":true,"uniqueKey":"alerts.items.[INDEX].firstTriagedAt.oneOf.0","typeLabel":"string"},{"type":"null","description":"ISO timestamp when triage first started","isRequired":true,"uniqueKey":"alerts.items.[INDEX].firstTriagedAt.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].firstTriagedAt","typeLabel":"string | null"},"resolvedAt":{"oneOf":[{"type":"string","description":"ISO timestamp when the alert reached a terminal closed status","isRequired":true,"uniqueKey":"alerts.items.[INDEX].resolvedAt.oneOf.0","typeLabel":"string"},{"type":"null","description":"ISO timestamp when the alert reached a terminal closed status","isRequired":true,"uniqueKey":"alerts.items.[INDEX].resolvedAt.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].resolvedAt","typeLabel":"string | null"},"derivedDisposition":{"oneOf":[{"type":"string","enum":["true_positive","false_positive","true_positive_benign",null],"description":"Disposition derived from terminal alert status","isRequired":true,"uniqueKey":"alerts.items.[INDEX].derivedDisposition.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["true_positive","false_positive","true_positive_benign",null],"description":"Disposition derived from terminal alert status","isRequired":true,"uniqueKey":"alerts.items.[INDEX].derivedDisposition.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].derivedDisposition","typeLabel":"enum\u003cstring> | null"},"originAgentName":{"oneOf":[{"type":"string","description":"Display name for the origin agent, when available","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originAgentName.oneOf.0","typeLabel":"string"},{"type":"null","description":"Display name for the origin agent, when available","isRequired":true,"uniqueKey":"alerts.items.[INDEX].originAgentName.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].originAgentName","typeLabel":"string | null"},"assignedAgentName":{"oneOf":[{"type":"string","description":"Display name for the assigned triage agent, when available","isRequired":true,"uniqueKey":"alerts.items.[INDEX].assignedAgentName.oneOf.0","typeLabel":"string"},{"type":"null","description":"Display name for the assigned triage agent, when available","isRequired":true,"uniqueKey":"alerts.items.[INDEX].assignedAgentName.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].assignedAgentName","typeLabel":"string | null"},"triggerSource":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source for external-trigger alerts","isRequired":true,"uniqueKey":"alerts.items.[INDEX].triggerSource.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source for external-trigger alerts","isRequired":true,"uniqueKey":"alerts.items.[INDEX].triggerSource.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"alerts.items.[INDEX].triggerSource","typeLabel":"enum\u003cstring> | null"},"duplicateOfAlertId":{"oneOf":[{"type":"string","format":"uuid","description":"Canonical alert this alert duplicates, when status is duplicate","uniqueKey":"alerts.items.[INDEX].duplicateOfAlertId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Canonical alert this alert duplicates, when status is duplicate","uniqueKey":"alerts.items.[INDEX].duplicateOfAlertId.oneOf.1","typeLabel":"null"}],"uniqueKey":"alerts.items.[INDEX].duplicateOfAlertId","typeLabel":"string\u003cuuid> | null"},"resolvedByType":{"oneOf":[{"type":"string","enum":["human","agent","system",null],"description":"Actor class that moved the alert to its terminal status. Null while the alert is not closed.","uniqueKey":"alerts.items.[INDEX].resolvedByType.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["human","agent","system",null],"description":"Actor class that moved the alert to its terminal status. Null while the alert is not closed.","uniqueKey":"alerts.items.[INDEX].resolvedByType.oneOf.1","typeLabel":"null"}],"uniqueKey":"alerts.items.[INDEX].resolvedByType","typeLabel":"enum\u003cstring> | null"},"resolvedByUserId":{"oneOf":[{"type":"string","format":"uuid","description":"User who closed the alert, when a human closed it","uniqueKey":"alerts.items.[INDEX].resolvedByUserId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"User who closed the alert, when a human closed it","uniqueKey":"alerts.items.[INDEX].resolvedByUserId.oneOf.1","typeLabel":"null"}],"uniqueKey":"alerts.items.[INDEX].resolvedByUserId","typeLabel":"string\u003cuuid> | null"},"resolvedByAgentName":{"oneOf":[{"type":"string","description":"Display name of the agent that closed the alert, when an agent closed it","uniqueKey":"alerts.items.[INDEX].resolvedByAgentName.oneOf.0","typeLabel":"string"},{"type":"null","description":"Display name of the agent that closed the alert, when an agent closed it","uniqueKey":"alerts.items.[INDEX].resolvedByAgentName.oneOf.1","typeLabel":"null"}],"uniqueKey":"alerts.items.[INDEX].resolvedByAgentName","typeLabel":"string | null"},"resolvedReason":{"oneOf":[{"type":"string","description":"Reason recorded with the closing status change, when provided","uniqueKey":"alerts.items.[INDEX].resolvedReason.oneOf.0","typeLabel":"string"},{"type":"null","description":"Reason recorded with the closing status change, when provided","uniqueKey":"alerts.items.[INDEX].resolvedReason.oneOf.1","typeLabel":"null"}],"uniqueKey":"alerts.items.[INDEX].resolvedReason","typeLabel":"string | null"},"huntQualifiedBy":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found",null],"description":"Qualifying condition that opened this Hunt alert. Null for non-hunt alerts.","uniqueKey":"alerts.items.[INDEX].huntQualifiedBy.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["compromise_signal_found","exposure_found",null],"description":"Qualifying condition that opened this Hunt alert. Null for non-hunt alerts.","uniqueKey":"alerts.items.[INDEX].huntQualifiedBy.oneOf.1","typeLabel":"null"}],"uniqueKey":"alerts.items.[INDEX].huntQualifiedBy","typeLabel":"enum\u003cstring> | null"},"alternativeExplanationCount":{"type":"integer","minimum":0,"description":"Number of alternative explanations offered on the latest escalation. Only meaningful while the alert is escalated.","uniqueKey":"alerts.items.[INDEX].alternativeExplanationCount","typeLabel":"integer"}},"required":["id","displayId","organizationId","organizationName","title","description","severity","status","duplicateCount","source","detection","createdBy","originAgentId","originTriggerId","originRunId","originDetectionHitId","codeDetectionId","originCodeDetectionHitId","externalProvider","externalRef","externalUrl","assignedAgentId","triageRunId","dedupeKey","createdAt","updatedAt","firstTriagedAt","resolvedAt","derivedDisposition","originAgentName","assignedAgentName","triggerSource"],"uniqueKey":"alerts.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"alerts","typeLabel":"object[]"},"activeHuntAlert":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Internal alert identifier","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.id","typeLabel":"string\u003cuuid>"},"displayId":{"type":"string","pattern":"^COT-\\d+$","description":"Human-readable alert identifier","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.displayId","typeLabel":"string"},"organizationId":{"type":"string","format":"uuid","description":"Organization that owns the alert","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.organizationId","typeLabel":"string\u003cuuid>"},"organizationName":{"type":"string","minLength":1,"description":"URL-safe organization name used in durable alert paths","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.organizationName","typeLabel":"string"},"title":{"type":"string","minLength":1,"description":"Human-readable alert title","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.title","typeLabel":"string"},"description":{"oneOf":[{"type":"string","description":"Markdown summary or details for the alert","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.description.oneOf.0","typeLabel":"string"},{"type":"null","description":"Markdown summary or details for the alert","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.description.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.description","typeLabel":"string | null"},"severity":{"oneOf":[{"type":"string","enum":["low","medium","high","critical",null],"description":"Alert severity when known","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.severity.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["low","medium","high","critical",null],"description":"Alert severity when known","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.severity.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.severity","typeLabel":"enum\u003cstring> | null"},"status":{"type":"string","enum":["open","in_progress","escalated","closed_true_positive","closed_false_positive","closed_true_positive_benign","dismissed","duplicate","expired"],"description":"Lifecycle status for a first-class alert. Terminal closed statuses include final disposition. Dismissed, duplicate, and expired alerts are archived and hidden from alert lists.","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.status","typeLabel":"enum\u003cstring>"},"duplicateCount":{"type":"integer","minimum":0,"description":"Number of alerts archived as duplicates of this alert. A high count means the same finding keeps recurring.","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.duplicateCount","typeLabel":"integer"},"source":{"type":"object","properties":{"category":{"type":"string","enum":["detection","trigger","hunt","api","agent"],"description":"Broad alert source category. Hunt covers threat-intel exposure alerts minted by the Hunt surface; api covers alerts submitted through an API source; agent covers alerts deliberately created by an agent.","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.source.category","typeLabel":"enum\u003cstring>"},"name":{"type":"string","enum":["cotool_detection","cotool_code","hunt","api","agent","jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon"],"description":"Filter-oriented alert source name. Trigger-created alerts use the trigger type.","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.source.name","typeLabel":"enum\u003cstring>"},"triggerType":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source when category is trigger","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.source.triggerType.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source when category is trigger","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.source.triggerType.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.source.triggerType","typeLabel":"enum\u003cstring> | null"}},"required":["category","name","triggerType"],"description":"Filter-oriented source attribution for an alert.","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.source","typeLabel":"object"},"detection":{"oneOf":[{"type":"object","properties":{"id":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection identifier when known","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.id.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Cotool detection identifier when known","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.id.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.id","typeLabel":"string\u003cuuid> | null"},"agentId":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection agent identifier when known","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.agentId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Cotool detection agent identifier when known","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.agentId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.agentId","typeLabel":"string\u003cuuid> | null"},"ruleId":{"oneOf":[{"type":"string","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.ruleId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.ruleId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.ruleId","typeLabel":"string\u003cuuid> | null"},"name":{"type":"string","minLength":1,"description":"Detection display name","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.name","typeLabel":"string"},"kind":{"type":"string","enum":["cotool","cotool_code","external"],"description":"Whether this detection attribution is internal or extracted","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.kind","typeLabel":"enum\u003cstring>"},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection identifier when this alert came from Code Mode","uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.codeDetectionId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Code detection identifier when this alert came from Code Mode","uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.codeDetectionId.oneOf.1","typeLabel":"null"}],"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.codeDetectionId","typeLabel":"string\u003cuuid> | null"},"origin":{"oneOf":[{"type":"string","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature.","uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.origin.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature.","uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.origin.oneOf.1","typeLabel":"null"}],"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0.origin","typeLabel":"enum\u003cstring> | null"}},"required":["id","agentId","ruleId","name","kind"],"description":"Detection attribution for the alert, when known.","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.0","typeLabel":"object"},{"type":"null","properties":{"id":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection identifier when known"}]},"agentId":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection agent identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection agent identifier when known"}]},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"},{"type":"null","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"}]},"ruleId":{"oneOf":[{"type":"string","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"},{"type":"null","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"}]},"name":{"type":"string","minLength":1,"description":"Detection display name"},"kind":{"type":"string","enum":["cotool","cotool_code","external"],"description":"Whether this detection attribution is internal or extracted"},"origin":{"oneOf":[{"type":"string","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."},{"type":"null","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."}]}},"required":["id","agentId","ruleId","name","kind"],"description":"Detection attribution for the alert, when known.","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.detection","typeLabel":"object | null"},"createdBy":{"type":"string","enum":["agent","trigger","system"],"description":"Actor class that created the alert.","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.createdBy","typeLabel":"enum\u003cstring>"},"originAgentId":{"oneOf":[{"type":"string","format":"uuid","description":"Agent that produced or owns the source flow","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originAgentId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Agent that produced or owns the source flow","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originAgentId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originAgentId","typeLabel":"string\u003cuuid> | null"},"originTriggerId":{"oneOf":[{"type":"string","format":"uuid","description":"Trigger that created this alert, when source is an external trigger","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originTriggerId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Trigger that created this alert, when source is an external trigger","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originTriggerId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originTriggerId","typeLabel":"string\u003cuuid> | null"},"originRunId":{"oneOf":[{"type":"string","format":"uuid","description":"Run that minted the alert, stored as chats.id","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originRunId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Run that minted the alert, stored as chats.id","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originRunId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originRunId","typeLabel":"string\u003cuuid> | null"},"originDetectionHitId":{"oneOf":[{"type":"string","format":"uuid","description":"Detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originDetectionHitId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originDetectionHitId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originDetectionHitId","typeLabel":"string\u003cuuid> | null"},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection that produced this alert, when applicable","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.codeDetectionId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Code detection that produced this alert, when applicable","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.codeDetectionId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.codeDetectionId","typeLabel":"string\u003cuuid> | null"},"originCodeDetectionHitId":{"oneOf":[{"type":"string","format":"uuid","description":"Code-detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originCodeDetectionHitId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Code-detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originCodeDetectionHitId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originCodeDetectionHitId","typeLabel":"string\u003cuuid> | null"},"externalProvider":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"External trigger provider such as jira, linear, email, or webhook","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.externalProvider.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"External trigger provider such as jira, linear, email, or webhook","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.externalProvider.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.externalProvider","typeLabel":"enum\u003cstring> | null"},"externalRef":{"oneOf":[{"type":"string","description":"Provider-native event, ticket, message, or alert identifier","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.externalRef.oneOf.0","typeLabel":"string"},{"type":"null","description":"Provider-native event, ticket, message, or alert identifier","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.externalRef.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.externalRef","typeLabel":"string | null"},"externalUrl":{"oneOf":[{"type":"string","format":"uri","description":"Provider-native URL for the originating object","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.externalUrl.oneOf.0","typeLabel":"string\u003curi>"},{"type":"null","format":"uri","description":"Provider-native URL for the originating object","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.externalUrl.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.externalUrl","typeLabel":"string\u003curi> | null"},"assignedAgentId":{"oneOf":[{"type":"string","format":"uuid","description":"Response agent currently assigned to triage this alert","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.assignedAgentId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Response agent currently assigned to triage this alert","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.assignedAgentId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.assignedAgentId","typeLabel":"string\u003cuuid> | null"},"triageRunId":{"oneOf":[{"type":"string","format":"uuid","description":"Latest response-agent triage run for this alert, stored as chats.id","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.triageRunId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Latest response-agent triage run for this alert, stored as chats.id","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.triageRunId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.triageRunId","typeLabel":"string\u003cuuid> | null"},"dedupeKey":{"oneOf":[{"type":"string","description":"Stable key used for idempotent alert creation","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.dedupeKey.oneOf.0","typeLabel":"string"},{"type":"null","description":"Stable key used for idempotent alert creation","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.dedupeKey.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.dedupeKey","typeLabel":"string | null"},"createdAt":{"type":"string","description":"ISO timestamp when the alert was created","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.createdAt","typeLabel":"string"},"updatedAt":{"type":"string","description":"ISO timestamp when the alert was last updated","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.updatedAt","typeLabel":"string"},"firstTriagedAt":{"oneOf":[{"type":"string","description":"ISO timestamp when triage first started","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.firstTriagedAt.oneOf.0","typeLabel":"string"},{"type":"null","description":"ISO timestamp when triage first started","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.firstTriagedAt.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.firstTriagedAt","typeLabel":"string | null"},"resolvedAt":{"oneOf":[{"type":"string","description":"ISO timestamp when the alert reached a terminal closed status","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.resolvedAt.oneOf.0","typeLabel":"string"},{"type":"null","description":"ISO timestamp when the alert reached a terminal closed status","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.resolvedAt.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.resolvedAt","typeLabel":"string | null"},"derivedDisposition":{"oneOf":[{"type":"string","enum":["true_positive","false_positive","true_positive_benign",null],"description":"Disposition derived from terminal alert status","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.derivedDisposition.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["true_positive","false_positive","true_positive_benign",null],"description":"Disposition derived from terminal alert status","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.derivedDisposition.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.derivedDisposition","typeLabel":"enum\u003cstring> | null"},"originAgentName":{"oneOf":[{"type":"string","description":"Display name for the origin agent, when available","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originAgentName.oneOf.0","typeLabel":"string"},{"type":"null","description":"Display name for the origin agent, when available","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originAgentName.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.originAgentName","typeLabel":"string | null"},"assignedAgentName":{"oneOf":[{"type":"string","description":"Display name for the assigned triage agent, when available","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.assignedAgentName.oneOf.0","typeLabel":"string"},{"type":"null","description":"Display name for the assigned triage agent, when available","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.assignedAgentName.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.assignedAgentName","typeLabel":"string | null"},"triggerSource":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source for external-trigger alerts","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.triggerSource.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source for external-trigger alerts","isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.triggerSource.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0.triggerSource","typeLabel":"enum\u003cstring> | null"},"duplicateOfAlertId":{"oneOf":[{"type":"string","format":"uuid","description":"Canonical alert this alert duplicates, when status is duplicate","uniqueKey":"activeHuntAlert.oneOf.0.duplicateOfAlertId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Canonical alert this alert duplicates, when status is duplicate","uniqueKey":"activeHuntAlert.oneOf.0.duplicateOfAlertId.oneOf.1","typeLabel":"null"}],"uniqueKey":"activeHuntAlert.oneOf.0.duplicateOfAlertId","typeLabel":"string\u003cuuid> | null"},"resolvedByType":{"oneOf":[{"type":"string","enum":["human","agent","system",null],"description":"Actor class that moved the alert to its terminal status. Null while the alert is not closed.","uniqueKey":"activeHuntAlert.oneOf.0.resolvedByType.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["human","agent","system",null],"description":"Actor class that moved the alert to its terminal status. Null while the alert is not closed.","uniqueKey":"activeHuntAlert.oneOf.0.resolvedByType.oneOf.1","typeLabel":"null"}],"uniqueKey":"activeHuntAlert.oneOf.0.resolvedByType","typeLabel":"enum\u003cstring> | null"},"resolvedByUserId":{"oneOf":[{"type":"string","format":"uuid","description":"User who closed the alert, when a human closed it","uniqueKey":"activeHuntAlert.oneOf.0.resolvedByUserId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"User who closed the alert, when a human closed it","uniqueKey":"activeHuntAlert.oneOf.0.resolvedByUserId.oneOf.1","typeLabel":"null"}],"uniqueKey":"activeHuntAlert.oneOf.0.resolvedByUserId","typeLabel":"string\u003cuuid> | null"},"resolvedByAgentName":{"oneOf":[{"type":"string","description":"Display name of the agent that closed the alert, when an agent closed it","uniqueKey":"activeHuntAlert.oneOf.0.resolvedByAgentName.oneOf.0","typeLabel":"string"},{"type":"null","description":"Display name of the agent that closed the alert, when an agent closed it","uniqueKey":"activeHuntAlert.oneOf.0.resolvedByAgentName.oneOf.1","typeLabel":"null"}],"uniqueKey":"activeHuntAlert.oneOf.0.resolvedByAgentName","typeLabel":"string | null"},"resolvedReason":{"oneOf":[{"type":"string","description":"Reason recorded with the closing status change, when provided","uniqueKey":"activeHuntAlert.oneOf.0.resolvedReason.oneOf.0","typeLabel":"string"},{"type":"null","description":"Reason recorded with the closing status change, when provided","uniqueKey":"activeHuntAlert.oneOf.0.resolvedReason.oneOf.1","typeLabel":"null"}],"uniqueKey":"activeHuntAlert.oneOf.0.resolvedReason","typeLabel":"string | null"},"huntQualifiedBy":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found",null],"description":"Qualifying condition that opened this Hunt alert. Null for non-hunt alerts.","uniqueKey":"activeHuntAlert.oneOf.0.huntQualifiedBy.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["compromise_signal_found","exposure_found",null],"description":"Qualifying condition that opened this Hunt alert. Null for non-hunt alerts.","uniqueKey":"activeHuntAlert.oneOf.0.huntQualifiedBy.oneOf.1","typeLabel":"null"}],"uniqueKey":"activeHuntAlert.oneOf.0.huntQualifiedBy","typeLabel":"enum\u003cstring> | null"},"alternativeExplanationCount":{"type":"integer","minimum":0,"description":"Number of alternative explanations offered on the latest escalation. Only meaningful while the alert is escalated.","uniqueKey":"activeHuntAlert.oneOf.0.alternativeExplanationCount","typeLabel":"integer"}},"required":["id","displayId","organizationId","organizationName","title","description","severity","status","duplicateCount","source","detection","createdBy","originAgentId","originTriggerId","originRunId","originDetectionHitId","codeDetectionId","originCodeDetectionHitId","externalProvider","externalRef","externalUrl","assignedAgentId","triageRunId","dedupeKey","createdAt","updatedAt","firstTriagedAt","resolvedAt","derivedDisposition","originAgentName","assignedAgentName","triggerSource"],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.0","typeLabel":"object"},{"type":"null","properties":{"id":{"type":"string","format":"uuid","description":"Internal alert identifier"},"displayId":{"type":"string","pattern":"^COT-\\d+$","description":"Human-readable alert identifier"},"organizationId":{"type":"string","format":"uuid","description":"Organization that owns the alert"},"organizationName":{"type":"string","minLength":1,"description":"URL-safe organization name used in durable alert paths"},"title":{"type":"string","minLength":1,"description":"Human-readable alert title"},"description":{"oneOf":[{"type":"string","description":"Markdown summary or details for the alert"},{"type":"null","description":"Markdown summary or details for the alert"}]},"severity":{"oneOf":[{"type":"string","enum":["low","medium","high","critical",null],"description":"Alert severity when known"},{"type":"null","enum":["low","medium","high","critical",null],"description":"Alert severity when known"}]},"status":{"type":"string","enum":["open","in_progress","escalated","closed_true_positive","closed_false_positive","closed_true_positive_benign","dismissed","duplicate","expired"],"description":"Lifecycle status for a first-class alert. Terminal closed statuses include final disposition. Dismissed, duplicate, and expired alerts are archived and hidden from alert lists."},"duplicateOfAlertId":{"oneOf":[{"type":"string","format":"uuid","description":"Canonical alert this alert duplicates, when status is duplicate"},{"type":"null","format":"uuid","description":"Canonical alert this alert duplicates, when status is duplicate"}]},"duplicateCount":{"type":"integer","minimum":0,"description":"Number of alerts archived as duplicates of this alert. A high count means the same finding keeps recurring."},"source":{"type":"object","properties":{"category":{"type":"string","enum":["detection","trigger","hunt","api","agent"],"description":"Broad alert source category. Hunt covers threat-intel exposure alerts minted by the Hunt surface; api covers alerts submitted through an API source; agent covers alerts deliberately created by an agent."},"name":{"type":"string","enum":["cotool_detection","cotool_code","hunt","api","agent","jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon"],"description":"Filter-oriented alert source name. Trigger-created alerts use the trigger type."},"triggerType":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source when category is trigger"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source when category is trigger"}]}},"required":["category","name","triggerType"],"description":"Filter-oriented source attribution for an alert."},"detection":{"oneOf":[{"type":"object","properties":{"id":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection identifier when known"}]},"agentId":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection agent identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection agent identifier when known"}]},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"},{"type":"null","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"}]},"ruleId":{"oneOf":[{"type":"string","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"},{"type":"null","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"}]},"name":{"type":"string","minLength":1,"description":"Detection display name"},"kind":{"type":"string","enum":["cotool","cotool_code","external"],"description":"Whether this detection attribution is internal or extracted"},"origin":{"oneOf":[{"type":"string","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."},{"type":"null","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."}]}},"required":["id","agentId","ruleId","name","kind"],"description":"Detection attribution for the alert, when known."},{"type":"null","properties":{"id":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection identifier when known"}]},"agentId":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection agent identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection agent identifier when known"}]},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"},{"type":"null","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"}]},"ruleId":{"oneOf":[{"type":"string","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"},{"type":"null","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"}]},"name":{"type":"string","minLength":1,"description":"Detection display name"},"kind":{"type":"string","enum":["cotool","cotool_code","external"],"description":"Whether this detection attribution is internal or extracted"},"origin":{"oneOf":[{"type":"string","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."},{"type":"null","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."}]}},"required":["id","agentId","ruleId","name","kind"],"description":"Detection attribution for the alert, when known."}]},"createdBy":{"type":"string","enum":["agent","trigger","system"],"description":"Actor class that created the alert."},"originAgentId":{"oneOf":[{"type":"string","format":"uuid","description":"Agent that produced or owns the source flow"},{"type":"null","format":"uuid","description":"Agent that produced or owns the source flow"}]},"originTriggerId":{"oneOf":[{"type":"string","format":"uuid","description":"Trigger that created this alert, when source is an external trigger"},{"type":"null","format":"uuid","description":"Trigger that created this alert, when source is an external trigger"}]},"originRunId":{"oneOf":[{"type":"string","format":"uuid","description":"Run that minted the alert, stored as chats.id"},{"type":"null","format":"uuid","description":"Run that minted the alert, stored as chats.id"}]},"originDetectionHitId":{"oneOf":[{"type":"string","format":"uuid","description":"Detection hit that produced this alert, when applicable"},{"type":"null","format":"uuid","description":"Detection hit that produced this alert, when applicable"}]},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection that produced this alert, when applicable"},{"type":"null","format":"uuid","description":"Code detection that produced this alert, when applicable"}]},"originCodeDetectionHitId":{"oneOf":[{"type":"string","format":"uuid","description":"Code-detection hit that produced this alert, when applicable"},{"type":"null","format":"uuid","description":"Code-detection hit that produced this alert, when applicable"}]},"externalProvider":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"External trigger provider such as jira, linear, email, or webhook"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"External trigger provider such as jira, linear, email, or webhook"}]},"externalRef":{"oneOf":[{"type":"string","description":"Provider-native event, ticket, message, or alert identifier"},{"type":"null","description":"Provider-native event, ticket, message, or alert identifier"}]},"externalUrl":{"oneOf":[{"type":"string","format":"uri","description":"Provider-native URL for the originating object"},{"type":"null","format":"uri","description":"Provider-native URL for the originating object"}]},"assignedAgentId":{"oneOf":[{"type":"string","format":"uuid","description":"Response agent currently assigned to triage this alert"},{"type":"null","format":"uuid","description":"Response agent currently assigned to triage this alert"}]},"triageRunId":{"oneOf":[{"type":"string","format":"uuid","description":"Latest response-agent triage run for this alert, stored as chats.id"},{"type":"null","format":"uuid","description":"Latest response-agent triage run for this alert, stored as chats.id"}]},"dedupeKey":{"oneOf":[{"type":"string","description":"Stable key used for idempotent alert creation"},{"type":"null","description":"Stable key used for idempotent alert creation"}]},"createdAt":{"type":"string","description":"ISO timestamp when the alert was created"},"updatedAt":{"type":"string","description":"ISO timestamp when the alert was last updated"},"firstTriagedAt":{"oneOf":[{"type":"string","description":"ISO timestamp when triage first started"},{"type":"null","description":"ISO timestamp when triage first started"}]},"resolvedAt":{"oneOf":[{"type":"string","description":"ISO timestamp when the alert reached a terminal closed status"},{"type":"null","description":"ISO timestamp when the alert reached a terminal closed status"}]},"derivedDisposition":{"oneOf":[{"type":"string","enum":["true_positive","false_positive","true_positive_benign",null],"description":"Disposition derived from terminal alert status"},{"type":"null","enum":["true_positive","false_positive","true_positive_benign",null],"description":"Disposition derived from terminal alert status"}]},"originAgentName":{"oneOf":[{"type":"string","description":"Display name for the origin agent, when available"},{"type":"null","description":"Display name for the origin agent, when available"}]},"assignedAgentName":{"oneOf":[{"type":"string","description":"Display name for the assigned triage agent, when available"},{"type":"null","description":"Display name for the assigned triage agent, when available"}]},"triggerSource":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source for external-trigger alerts"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source for external-trigger alerts"}]},"resolvedByType":{"oneOf":[{"type":"string","enum":["human","agent","system",null],"description":"Actor class that moved the alert to its terminal status. Null while the alert is not closed."},{"type":"null","enum":["human","agent","system",null],"description":"Actor class that moved the alert to its terminal status. Null while the alert is not closed."}]},"resolvedByUserId":{"oneOf":[{"type":"string","format":"uuid","description":"User who closed the alert, when a human closed it"},{"type":"null","format":"uuid","description":"User who closed the alert, when a human closed it"}]},"resolvedByAgentName":{"oneOf":[{"type":"string","description":"Display name of the agent that closed the alert, when an agent closed it"},{"type":"null","description":"Display name of the agent that closed the alert, when an agent closed it"}]},"resolvedReason":{"oneOf":[{"type":"string","description":"Reason recorded with the closing status change, when provided"},{"type":"null","description":"Reason recorded with the closing status change, when provided"}]},"huntQualifiedBy":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found",null],"description":"Qualifying condition that opened this Hunt alert. Null for non-hunt alerts."},{"type":"null","enum":["compromise_signal_found","exposure_found",null],"description":"Qualifying condition that opened this Hunt alert. Null for non-hunt alerts."}]},"alternativeExplanationCount":{"type":"integer","minimum":0,"description":"Number of alternative explanations offered on the latest escalation. Only meaningful while the alert is escalated."}},"required":["id","displayId","organizationId","organizationName","title","description","severity","status","duplicateCount","source","detection","createdBy","originAgentId","originTriggerId","originRunId","originDetectionHitId","codeDetectionId","originCodeDetectionHitId","externalProvider","externalRef","externalUrl","assignedAgentId","triageRunId","dedupeKey","createdAt","updatedAt","firstTriagedAt","resolvedAt","derivedDisposition","originAgentName","assignedAgentName","triggerSource"],"isRequired":true,"uniqueKey":"activeHuntAlert.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activeHuntAlert","typeLabel":"object | null"},"latestAlert":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Internal alert identifier","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.id","typeLabel":"string\u003cuuid>"},"displayId":{"type":"string","pattern":"^COT-\\d+$","description":"Human-readable alert identifier","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.displayId","typeLabel":"string"},"organizationId":{"type":"string","format":"uuid","description":"Organization that owns the alert","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.organizationId","typeLabel":"string\u003cuuid>"},"organizationName":{"type":"string","minLength":1,"description":"URL-safe organization name used in durable alert paths","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.organizationName","typeLabel":"string"},"title":{"type":"string","minLength":1,"description":"Human-readable alert title","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.title","typeLabel":"string"},"description":{"oneOf":[{"type":"string","description":"Markdown summary or details for the alert","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.description.oneOf.0","typeLabel":"string"},{"type":"null","description":"Markdown summary or details for the alert","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.description.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.description","typeLabel":"string | null"},"severity":{"oneOf":[{"type":"string","enum":["low","medium","high","critical",null],"description":"Alert severity when known","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.severity.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["low","medium","high","critical",null],"description":"Alert severity when known","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.severity.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.severity","typeLabel":"enum\u003cstring> | null"},"status":{"type":"string","enum":["open","in_progress","escalated","closed_true_positive","closed_false_positive","closed_true_positive_benign","dismissed","duplicate","expired"],"description":"Lifecycle status for a first-class alert. Terminal closed statuses include final disposition. Dismissed, duplicate, and expired alerts are archived and hidden from alert lists.","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.status","typeLabel":"enum\u003cstring>"},"duplicateCount":{"type":"integer","minimum":0,"description":"Number of alerts archived as duplicates of this alert. A high count means the same finding keeps recurring.","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.duplicateCount","typeLabel":"integer"},"source":{"type":"object","properties":{"category":{"type":"string","enum":["detection","trigger","hunt","api","agent"],"description":"Broad alert source category. Hunt covers threat-intel exposure alerts minted by the Hunt surface; api covers alerts submitted through an API source; agent covers alerts deliberately created by an agent.","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.source.category","typeLabel":"enum\u003cstring>"},"name":{"type":"string","enum":["cotool_detection","cotool_code","hunt","api","agent","jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon"],"description":"Filter-oriented alert source name. Trigger-created alerts use the trigger type.","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.source.name","typeLabel":"enum\u003cstring>"},"triggerType":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source when category is trigger","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.source.triggerType.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source when category is trigger","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.source.triggerType.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.source.triggerType","typeLabel":"enum\u003cstring> | null"}},"required":["category","name","triggerType"],"description":"Filter-oriented source attribution for an alert.","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.source","typeLabel":"object"},"detection":{"oneOf":[{"type":"object","properties":{"id":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection identifier when known","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.id.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Cotool detection identifier when known","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.id.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.id","typeLabel":"string\u003cuuid> | null"},"agentId":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection agent identifier when known","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.agentId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Cotool detection agent identifier when known","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.agentId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.agentId","typeLabel":"string\u003cuuid> | null"},"ruleId":{"oneOf":[{"type":"string","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.ruleId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.ruleId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.ruleId","typeLabel":"string\u003cuuid> | null"},"name":{"type":"string","minLength":1,"description":"Detection display name","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.name","typeLabel":"string"},"kind":{"type":"string","enum":["cotool","cotool_code","external"],"description":"Whether this detection attribution is internal or extracted","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.kind","typeLabel":"enum\u003cstring>"},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection identifier when this alert came from Code Mode","uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.codeDetectionId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Code detection identifier when this alert came from Code Mode","uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.codeDetectionId.oneOf.1","typeLabel":"null"}],"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.codeDetectionId","typeLabel":"string\u003cuuid> | null"},"origin":{"oneOf":[{"type":"string","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature.","uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.origin.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature.","uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.origin.oneOf.1","typeLabel":"null"}],"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0.origin","typeLabel":"enum\u003cstring> | null"}},"required":["id","agentId","ruleId","name","kind"],"description":"Detection attribution for the alert, when known.","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.0","typeLabel":"object"},{"type":"null","properties":{"id":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection identifier when known"}]},"agentId":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection agent identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection agent identifier when known"}]},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"},{"type":"null","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"}]},"ruleId":{"oneOf":[{"type":"string","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"},{"type":"null","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"}]},"name":{"type":"string","minLength":1,"description":"Detection display name"},"kind":{"type":"string","enum":["cotool","cotool_code","external"],"description":"Whether this detection attribution is internal or extracted"},"origin":{"oneOf":[{"type":"string","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."},{"type":"null","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."}]}},"required":["id","agentId","ruleId","name","kind"],"description":"Detection attribution for the alert, when known.","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.detection","typeLabel":"object | null"},"createdBy":{"type":"string","enum":["agent","trigger","system"],"description":"Actor class that created the alert.","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.createdBy","typeLabel":"enum\u003cstring>"},"originAgentId":{"oneOf":[{"type":"string","format":"uuid","description":"Agent that produced or owns the source flow","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originAgentId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Agent that produced or owns the source flow","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originAgentId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originAgentId","typeLabel":"string\u003cuuid> | null"},"originTriggerId":{"oneOf":[{"type":"string","format":"uuid","description":"Trigger that created this alert, when source is an external trigger","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originTriggerId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Trigger that created this alert, when source is an external trigger","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originTriggerId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originTriggerId","typeLabel":"string\u003cuuid> | null"},"originRunId":{"oneOf":[{"type":"string","format":"uuid","description":"Run that minted the alert, stored as chats.id","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originRunId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Run that minted the alert, stored as chats.id","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originRunId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originRunId","typeLabel":"string\u003cuuid> | null"},"originDetectionHitId":{"oneOf":[{"type":"string","format":"uuid","description":"Detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originDetectionHitId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originDetectionHitId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originDetectionHitId","typeLabel":"string\u003cuuid> | null"},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection that produced this alert, when applicable","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.codeDetectionId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Code detection that produced this alert, when applicable","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.codeDetectionId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.codeDetectionId","typeLabel":"string\u003cuuid> | null"},"originCodeDetectionHitId":{"oneOf":[{"type":"string","format":"uuid","description":"Code-detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originCodeDetectionHitId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Code-detection hit that produced this alert, when applicable","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originCodeDetectionHitId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originCodeDetectionHitId","typeLabel":"string\u003cuuid> | null"},"externalProvider":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"External trigger provider such as jira, linear, email, or webhook","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.externalProvider.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"External trigger provider such as jira, linear, email, or webhook","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.externalProvider.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.externalProvider","typeLabel":"enum\u003cstring> | null"},"externalRef":{"oneOf":[{"type":"string","description":"Provider-native event, ticket, message, or alert identifier","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.externalRef.oneOf.0","typeLabel":"string"},{"type":"null","description":"Provider-native event, ticket, message, or alert identifier","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.externalRef.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.externalRef","typeLabel":"string | null"},"externalUrl":{"oneOf":[{"type":"string","format":"uri","description":"Provider-native URL for the originating object","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.externalUrl.oneOf.0","typeLabel":"string\u003curi>"},{"type":"null","format":"uri","description":"Provider-native URL for the originating object","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.externalUrl.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.externalUrl","typeLabel":"string\u003curi> | null"},"assignedAgentId":{"oneOf":[{"type":"string","format":"uuid","description":"Response agent currently assigned to triage this alert","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.assignedAgentId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Response agent currently assigned to triage this alert","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.assignedAgentId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.assignedAgentId","typeLabel":"string\u003cuuid> | null"},"triageRunId":{"oneOf":[{"type":"string","format":"uuid","description":"Latest response-agent triage run for this alert, stored as chats.id","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.triageRunId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Latest response-agent triage run for this alert, stored as chats.id","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.triageRunId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.triageRunId","typeLabel":"string\u003cuuid> | null"},"dedupeKey":{"oneOf":[{"type":"string","description":"Stable key used for idempotent alert creation","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.dedupeKey.oneOf.0","typeLabel":"string"},{"type":"null","description":"Stable key used for idempotent alert creation","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.dedupeKey.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.dedupeKey","typeLabel":"string | null"},"createdAt":{"type":"string","description":"ISO timestamp when the alert was created","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.createdAt","typeLabel":"string"},"updatedAt":{"type":"string","description":"ISO timestamp when the alert was last updated","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.updatedAt","typeLabel":"string"},"firstTriagedAt":{"oneOf":[{"type":"string","description":"ISO timestamp when triage first started","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.firstTriagedAt.oneOf.0","typeLabel":"string"},{"type":"null","description":"ISO timestamp when triage first started","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.firstTriagedAt.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.firstTriagedAt","typeLabel":"string | null"},"resolvedAt":{"oneOf":[{"type":"string","description":"ISO timestamp when the alert reached a terminal closed status","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.resolvedAt.oneOf.0","typeLabel":"string"},{"type":"null","description":"ISO timestamp when the alert reached a terminal closed status","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.resolvedAt.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.resolvedAt","typeLabel":"string | null"},"derivedDisposition":{"oneOf":[{"type":"string","enum":["true_positive","false_positive","true_positive_benign",null],"description":"Disposition derived from terminal alert status","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.derivedDisposition.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["true_positive","false_positive","true_positive_benign",null],"description":"Disposition derived from terminal alert status","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.derivedDisposition.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.derivedDisposition","typeLabel":"enum\u003cstring> | null"},"originAgentName":{"oneOf":[{"type":"string","description":"Display name for the origin agent, when available","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originAgentName.oneOf.0","typeLabel":"string"},{"type":"null","description":"Display name for the origin agent, when available","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originAgentName.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.originAgentName","typeLabel":"string | null"},"assignedAgentName":{"oneOf":[{"type":"string","description":"Display name for the assigned triage agent, when available","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.assignedAgentName.oneOf.0","typeLabel":"string"},{"type":"null","description":"Display name for the assigned triage agent, when available","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.assignedAgentName.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.assignedAgentName","typeLabel":"string | null"},"triggerSource":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source for external-trigger alerts","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.triggerSource.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source for external-trigger alerts","isRequired":true,"uniqueKey":"latestAlert.oneOf.0.triggerSource.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0.triggerSource","typeLabel":"enum\u003cstring> | null"},"duplicateOfAlertId":{"oneOf":[{"type":"string","format":"uuid","description":"Canonical alert this alert duplicates, when status is duplicate","uniqueKey":"latestAlert.oneOf.0.duplicateOfAlertId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"Canonical alert this alert duplicates, when status is duplicate","uniqueKey":"latestAlert.oneOf.0.duplicateOfAlertId.oneOf.1","typeLabel":"null"}],"uniqueKey":"latestAlert.oneOf.0.duplicateOfAlertId","typeLabel":"string\u003cuuid> | null"},"resolvedByType":{"oneOf":[{"type":"string","enum":["human","agent","system",null],"description":"Actor class that moved the alert to its terminal status. Null while the alert is not closed.","uniqueKey":"latestAlert.oneOf.0.resolvedByType.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["human","agent","system",null],"description":"Actor class that moved the alert to its terminal status. Null while the alert is not closed.","uniqueKey":"latestAlert.oneOf.0.resolvedByType.oneOf.1","typeLabel":"null"}],"uniqueKey":"latestAlert.oneOf.0.resolvedByType","typeLabel":"enum\u003cstring> | null"},"resolvedByUserId":{"oneOf":[{"type":"string","format":"uuid","description":"User who closed the alert, when a human closed it","uniqueKey":"latestAlert.oneOf.0.resolvedByUserId.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","description":"User who closed the alert, when a human closed it","uniqueKey":"latestAlert.oneOf.0.resolvedByUserId.oneOf.1","typeLabel":"null"}],"uniqueKey":"latestAlert.oneOf.0.resolvedByUserId","typeLabel":"string\u003cuuid> | null"},"resolvedByAgentName":{"oneOf":[{"type":"string","description":"Display name of the agent that closed the alert, when an agent closed it","uniqueKey":"latestAlert.oneOf.0.resolvedByAgentName.oneOf.0","typeLabel":"string"},{"type":"null","description":"Display name of the agent that closed the alert, when an agent closed it","uniqueKey":"latestAlert.oneOf.0.resolvedByAgentName.oneOf.1","typeLabel":"null"}],"uniqueKey":"latestAlert.oneOf.0.resolvedByAgentName","typeLabel":"string | null"},"resolvedReason":{"oneOf":[{"type":"string","description":"Reason recorded with the closing status change, when provided","uniqueKey":"latestAlert.oneOf.0.resolvedReason.oneOf.0","typeLabel":"string"},{"type":"null","description":"Reason recorded with the closing status change, when provided","uniqueKey":"latestAlert.oneOf.0.resolvedReason.oneOf.1","typeLabel":"null"}],"uniqueKey":"latestAlert.oneOf.0.resolvedReason","typeLabel":"string | null"},"huntQualifiedBy":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found",null],"description":"Qualifying condition that opened this Hunt alert. Null for non-hunt alerts.","uniqueKey":"latestAlert.oneOf.0.huntQualifiedBy.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["compromise_signal_found","exposure_found",null],"description":"Qualifying condition that opened this Hunt alert. Null for non-hunt alerts.","uniqueKey":"latestAlert.oneOf.0.huntQualifiedBy.oneOf.1","typeLabel":"null"}],"uniqueKey":"latestAlert.oneOf.0.huntQualifiedBy","typeLabel":"enum\u003cstring> | null"},"alternativeExplanationCount":{"type":"integer","minimum":0,"description":"Number of alternative explanations offered on the latest escalation. Only meaningful while the alert is escalated.","uniqueKey":"latestAlert.oneOf.0.alternativeExplanationCount","typeLabel":"integer"}},"required":["id","displayId","organizationId","organizationName","title","description","severity","status","duplicateCount","source","detection","createdBy","originAgentId","originTriggerId","originRunId","originDetectionHitId","codeDetectionId","originCodeDetectionHitId","externalProvider","externalRef","externalUrl","assignedAgentId","triageRunId","dedupeKey","createdAt","updatedAt","firstTriagedAt","resolvedAt","derivedDisposition","originAgentName","assignedAgentName","triggerSource"],"isRequired":true,"uniqueKey":"latestAlert.oneOf.0","typeLabel":"object"},{"type":"null","properties":{"id":{"type":"string","format":"uuid","description":"Internal alert identifier"},"displayId":{"type":"string","pattern":"^COT-\\d+$","description":"Human-readable alert identifier"},"organizationId":{"type":"string","format":"uuid","description":"Organization that owns the alert"},"organizationName":{"type":"string","minLength":1,"description":"URL-safe organization name used in durable alert paths"},"title":{"type":"string","minLength":1,"description":"Human-readable alert title"},"description":{"oneOf":[{"type":"string","description":"Markdown summary or details for the alert"},{"type":"null","description":"Markdown summary or details for the alert"}]},"severity":{"oneOf":[{"type":"string","enum":["low","medium","high","critical",null],"description":"Alert severity when known"},{"type":"null","enum":["low","medium","high","critical",null],"description":"Alert severity when known"}]},"status":{"type":"string","enum":["open","in_progress","escalated","closed_true_positive","closed_false_positive","closed_true_positive_benign","dismissed","duplicate","expired"],"description":"Lifecycle status for a first-class alert. Terminal closed statuses include final disposition. Dismissed, duplicate, and expired alerts are archived and hidden from alert lists."},"duplicateOfAlertId":{"oneOf":[{"type":"string","format":"uuid","description":"Canonical alert this alert duplicates, when status is duplicate"},{"type":"null","format":"uuid","description":"Canonical alert this alert duplicates, when status is duplicate"}]},"duplicateCount":{"type":"integer","minimum":0,"description":"Number of alerts archived as duplicates of this alert. A high count means the same finding keeps recurring."},"source":{"type":"object","properties":{"category":{"type":"string","enum":["detection","trigger","hunt","api","agent"],"description":"Broad alert source category. Hunt covers threat-intel exposure alerts minted by the Hunt surface; api covers alerts submitted through an API source; agent covers alerts deliberately created by an agent."},"name":{"type":"string","enum":["cotool_detection","cotool_code","hunt","api","agent","jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon"],"description":"Filter-oriented alert source name. Trigger-created alerts use the trigger type."},"triggerType":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source when category is trigger"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source when category is trigger"}]}},"required":["category","name","triggerType"],"description":"Filter-oriented source attribution for an alert."},"detection":{"oneOf":[{"type":"object","properties":{"id":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection identifier when known"}]},"agentId":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection agent identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection agent identifier when known"}]},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"},{"type":"null","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"}]},"ruleId":{"oneOf":[{"type":"string","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"},{"type":"null","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"}]},"name":{"type":"string","minLength":1,"description":"Detection display name"},"kind":{"type":"string","enum":["cotool","cotool_code","external"],"description":"Whether this detection attribution is internal or extracted"},"origin":{"oneOf":[{"type":"string","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."},{"type":"null","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."}]}},"required":["id","agentId","ruleId","name","kind"],"description":"Detection attribution for the alert, when known."},{"type":"null","properties":{"id":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection identifier when known"}]},"agentId":{"oneOf":[{"type":"string","format":"uuid","description":"Cotool detection agent identifier when known"},{"type":"null","format":"uuid","description":"Cotool detection agent identifier when known"}]},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"},{"type":"null","format":"uuid","description":"Code detection identifier when this alert came from Code Mode"}]},"ruleId":{"oneOf":[{"type":"string","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"},{"type":"null","format":"uuid","description":"Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule"}]},"name":{"type":"string","minLength":1,"description":"Detection display name"},"kind":{"type":"string","enum":["cotool","cotool_code","external"],"description":"Whether this detection attribution is internal or extracted"},"origin":{"oneOf":[{"type":"string","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."},{"type":"null","enum":["user","orchestrator",null],"description":"Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature."}]}},"required":["id","agentId","ruleId","name","kind"],"description":"Detection attribution for the alert, when known."}]},"createdBy":{"type":"string","enum":["agent","trigger","system"],"description":"Actor class that created the alert."},"originAgentId":{"oneOf":[{"type":"string","format":"uuid","description":"Agent that produced or owns the source flow"},{"type":"null","format":"uuid","description":"Agent that produced or owns the source flow"}]},"originTriggerId":{"oneOf":[{"type":"string","format":"uuid","description":"Trigger that created this alert, when source is an external trigger"},{"type":"null","format":"uuid","description":"Trigger that created this alert, when source is an external trigger"}]},"originRunId":{"oneOf":[{"type":"string","format":"uuid","description":"Run that minted the alert, stored as chats.id"},{"type":"null","format":"uuid","description":"Run that minted the alert, stored as chats.id"}]},"originDetectionHitId":{"oneOf":[{"type":"string","format":"uuid","description":"Detection hit that produced this alert, when applicable"},{"type":"null","format":"uuid","description":"Detection hit that produced this alert, when applicable"}]},"codeDetectionId":{"oneOf":[{"type":"string","format":"uuid","description":"Code detection that produced this alert, when applicable"},{"type":"null","format":"uuid","description":"Code detection that produced this alert, when applicable"}]},"originCodeDetectionHitId":{"oneOf":[{"type":"string","format":"uuid","description":"Code-detection hit that produced this alert, when applicable"},{"type":"null","format":"uuid","description":"Code-detection hit that produced this alert, when applicable"}]},"externalProvider":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"External trigger provider such as jira, linear, email, or webhook"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"External trigger provider such as jira, linear, email, or webhook"}]},"externalRef":{"oneOf":[{"type":"string","description":"Provider-native event, ticket, message, or alert identifier"},{"type":"null","description":"Provider-native event, ticket, message, or alert identifier"}]},"externalUrl":{"oneOf":[{"type":"string","format":"uri","description":"Provider-native URL for the originating object"},{"type":"null","format":"uri","description":"Provider-native URL for the originating object"}]},"assignedAgentId":{"oneOf":[{"type":"string","format":"uuid","description":"Response agent currently assigned to triage this alert"},{"type":"null","format":"uuid","description":"Response agent currently assigned to triage this alert"}]},"triageRunId":{"oneOf":[{"type":"string","format":"uuid","description":"Latest response-agent triage run for this alert, stored as chats.id"},{"type":"null","format":"uuid","description":"Latest response-agent triage run for this alert, stored as chats.id"}]},"dedupeKey":{"oneOf":[{"type":"string","description":"Stable key used for idempotent alert creation"},{"type":"null","description":"Stable key used for idempotent alert creation"}]},"createdAt":{"type":"string","description":"ISO timestamp when the alert was created"},"updatedAt":{"type":"string","description":"ISO timestamp when the alert was last updated"},"firstTriagedAt":{"oneOf":[{"type":"string","description":"ISO timestamp when triage first started"},{"type":"null","description":"ISO timestamp when triage first started"}]},"resolvedAt":{"oneOf":[{"type":"string","description":"ISO timestamp when the alert reached a terminal closed status"},{"type":"null","description":"ISO timestamp when the alert reached a terminal closed status"}]},"derivedDisposition":{"oneOf":[{"type":"string","enum":["true_positive","false_positive","true_positive_benign",null],"description":"Disposition derived from terminal alert status"},{"type":"null","enum":["true_positive","false_positive","true_positive_benign",null],"description":"Disposition derived from terminal alert status"}]},"originAgentName":{"oneOf":[{"type":"string","description":"Display name for the origin agent, when available"},{"type":"null","description":"Display name for the origin agent, when available"}]},"assignedAgentName":{"oneOf":[{"type":"string","description":"Display name for the assigned triage agent, when available"},{"type":"null","description":"Display name for the assigned triage agent, when available"}]},"triggerSource":{"oneOf":[{"type":"string","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source for external-trigger alerts"},{"type":"null","enum":["jira","jira-automation","slack","linear","cron","webhook","email","bugcrowd","hackerone","zscaler","darktrace","seon",null],"description":"Trigger source for external-trigger alerts"}]},"resolvedByType":{"oneOf":[{"type":"string","enum":["human","agent","system",null],"description":"Actor class that moved the alert to its terminal status. Null while the alert is not closed."},{"type":"null","enum":["human","agent","system",null],"description":"Actor class that moved the alert to its terminal status. Null while the alert is not closed."}]},"resolvedByUserId":{"oneOf":[{"type":"string","format":"uuid","description":"User who closed the alert, when a human closed it"},{"type":"null","format":"uuid","description":"User who closed the alert, when a human closed it"}]},"resolvedByAgentName":{"oneOf":[{"type":"string","description":"Display name of the agent that closed the alert, when an agent closed it"},{"type":"null","description":"Display name of the agent that closed the alert, when an agent closed it"}]},"resolvedReason":{"oneOf":[{"type":"string","description":"Reason recorded with the closing status change, when provided"},{"type":"null","description":"Reason recorded with the closing status change, when provided"}]},"huntQualifiedBy":{"oneOf":[{"type":"string","enum":["compromise_signal_found","exposure_found",null],"description":"Qualifying condition that opened this Hunt alert. Null for non-hunt alerts."},{"type":"null","enum":["compromise_signal_found","exposure_found",null],"description":"Qualifying condition that opened this Hunt alert. Null for non-hunt alerts."}]},"alternativeExplanationCount":{"type":"integer","minimum":0,"description":"Number of alternative explanations offered on the latest escalation. Only meaningful while the alert is escalated."}},"required":["id","displayId","organizationId","organizationName","title","description","severity","status","duplicateCount","source","detection","createdBy","originAgentId","originTriggerId","originRunId","originDetectionHitId","codeDetectionId","originCodeDetectionHitId","externalProvider","externalRef","externalUrl","assignedAgentId","triageRunId","dedupeKey","createdAt","updatedAt","firstTriagedAt","resolvedAt","derivedDisposition","originAgentName","assignedAgentName","triggerSource"],"isRequired":true,"uniqueKey":"latestAlert.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"latestAlert","typeLabel":"object | null"},"activityEvents":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].id","typeLabel":"string"},"threatId":{"type":"string","isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].threatId","typeLabel":"string"},"kind":{"type":"string","enum":["threat_created","intel_attached","reassessment_requested","assessment_started","relevancy_completed","exposure_started","assessment_failed"],"isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].kind","typeLabel":"enum\u003cstring>"},"actorType":{"type":"string","enum":["system","agent","human"],"isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].actorType","typeLabel":"enum\u003cstring>"},"runId":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].runId.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].runId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].runId","typeLabel":"string | null"},"metadata":{"oneOf":[{"type":"object","properties":{"score":{"type":"number","uniqueKey":"activityEvents.items.[INDEX].metadata.oneOf.0.score","typeLabel":"number"},"hunting":{"type":"boolean","uniqueKey":"activityEvents.items.[INDEX].metadata.oneOf.0.hunting","typeLabel":"boolean"},"executionId":{"type":"string","uniqueKey":"activityEvents.items.[INDEX].metadata.oneOf.0.executionId","typeLabel":"string"},"canonicalKey":{"type":"string","uniqueKey":"activityEvents.items.[INDEX].metadata.oneOf.0.canonicalKey","typeLabel":"string"},"label":{"type":"string","uniqueKey":"activityEvents.items.[INDEX].metadata.oneOf.0.label","typeLabel":"string"},"userId":{"type":"string","uniqueKey":"activityEvents.items.[INDEX].metadata.oneOf.0.userId","typeLabel":"string"}},"isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].metadata.oneOf.0","typeLabel":"object"},{"type":"null","properties":{"score":{"type":"number"},"hunting":{"type":"boolean"},"executionId":{"type":"string"},"canonicalKey":{"type":"string"},"label":{"type":"string"},"userId":{"type":"string"}},"isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].metadata.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].metadata","typeLabel":"object | null"},"createdAt":{"type":"string","isRequired":true,"uniqueKey":"activityEvents.items.[INDEX].createdAt","typeLabel":"string"}},"required":["id","threatId","kind","actorType","runId","metadata","createdAt"],"uniqueKey":"activityEvents.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"activityEvents","typeLabel":"object[]"},"capabilities":{"type":"object","properties":{"canReadEvidence":{"type":"boolean","isRequired":true,"uniqueKey":"capabilities.canReadEvidence","typeLabel":"boolean"},"canReassess":{"type":"boolean","isRequired":true,"uniqueKey":"capabilities.canReassess","typeLabel":"boolean"},"canTriage":{"type":"boolean","isRequired":true,"uniqueKey":"capabilities.canTriage","typeLabel":"boolean"}},"required":["canReadEvidence","canReassess","canTriage"],"uniqueKey":"capabilities","typeLabel":"object"}},"required":["threat","runs","deliverables","intelItems","alerts","activeHuntAlert","latestAlert","activityEvents"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"threat":{"id":"\u003cstring>","organizationId":"\u003cstring>","canonicalType":"vulnerability","canonicalKeyType":"cve","canonicalKey":"\u003cstring>","title":"\u003cstring>","aliases":["\u003cstring>"],"actorId":"\u003cstring>","intelItemIds":["\u003cstring>"],"relevancyScore":123,"exposureScore":123,"exposureState":"compromise_signal_found","coverageState":"none","detectionEngineeringNote":"\u003cstring>","latestRunId":"\u003cstring>","assessmentRunningExecutionId":"\u003cstring>","assessmentFailedAt":"\u003cstring>","latestAlertId":"\u003cstring>","activeHuntAlertId":"\u003cstring>","dismissedAt":"\u003cstring>","dismissedByUserId":"\u003cstring>","dismissedReason":"\u003cstring>","createdAt":"\u003cstring>","updatedAt":"\u003cstring>"},"runs":[{"id":"\u003cstring>","threatId":"\u003cstring>","kind":"create","trigger":"new_threat","runAt":"\u003cstring>","relevancyExecutionId":"\u003cstring>","relevancyScore":123,"relevancyExplanation":["\u003cstring>"],"exposureExecutionId":"\u003cstring>","exposureScore":123,"exposureState":"compromise_signal_found","exposureStory":{"exposureState":"compromise_signal_found","summary":["\u003cstring>"],"exposureChecks":[{"purpose":"exposure","checked":"\u003cstring>","source":"\u003cstring>","scope":"\u003cstring>","timeWindow":{"start":"\u003cstring>","end":"\u003cstring>"},"outcome":"found","evidence":"\u003cstring>","limitations":["\u003cstring>"],"indicatorId":"\u003cstring>","authoritative":true,"iocType":"ip","indicatorRole":"compromise"}],"assets":[{"identifier":"\u003cstring>","kind":"other","platform":null,"source":"\u003cstring>","internetFacing":true,"evidence":"\u003cstring>"}],"iocFindings":[{"iocType":"ip","role":"compromise","platform":null,"iocValue":"\u003cstring>","evidence":"\u003cstring>","affectedSystems":["\u003cstring>"],"indicatorId":"\u003cstring>","authoritative":true}],"detectionCoverage":{"state":"none","searches":[{"source":"\u003cstring>","criteria":"\u003cstring>","resultCount":123,"evidence":"\u003cstring>","limitations":["\u003cstring>"]}],"matches":[{"ref":{"id":"\u003cstring>","name":"\u003cstring>","kind":"rule_proposal","platform":"\u003cstring>","url":"\u003cstring>"},"coverage":"partial","rationale":"\u003cstring>","limitations":["\u003cstring>"]}]},"gaps":[{"product":"\u003cstring>","logSource":"\u003cstring>","scopeType":"org","scopeId":"\u003cstring>","scopeKey":"\u003cstring>","blocking":true,"description":"\u003cstring>","limitations":["\u003cstring>"]}],"nextSteps":["\u003cstring>"],"executionId":"\u003cstring>","runAt":"\u003cstring>","headline":"\u003cstring>","discoveredIndicators":[{"indicatorId":"\u003cstring>","iocType":"ip","role":"compromise","iocValue":"\u003cstring>","roleRationale":"\u003cstring>","evidence":"\u003cstring>","platform":"\u003cstring>"}],"observations":[{"observationId":"\u003cstring>","kind":"software_presence","summary":"\u003cstring>","evidence":"\u003cstring>","affectedSystems":["\u003cstring>"],"timeWindow":{"start":"\u003cstring>","end":"\u003cstring>"}}],"researchContext":[{"contextId":"\u003cstring>","summary":"\u003cstring>","evidence":"\u003cstring>"}],"conclusion":{"headline":"\u003cstring>","summary":["\u003cstring>"],"supportingFindingIds":["\u003cstring>"],"contextIds":["\u003cstring>"]},"timeline":[{"timestamp":"\u003cstring>","description":"\u003cstring>"}]},"coverageState":"none","hasFoundIoc":true,"hasBlockingGap":true,"diff":{"prevRunId":"\u003cstring>","beforeExposureScore":123,"afterExposureScore":123,"beforeExposureState":"compromise_signal_found","afterExposureState":"compromise_signal_found","beforeCoverageState":"none","afterCoverageState":"none","reasons":["\u003cstring>"]},"relevancyHeadline":"\u003cstring>"}],"deliverables":[{"id":"\u003cstring>","organizationId":"\u003cstring>","threatId":"\u003cstring>","executionId":"\u003cstring>","createdAt":"\u003cstring>","supersededById":"\u003cstring>","kind":"rule_proposal","proposalId":"\u003cstring>","pullRequestUrl":"\u003cstring>","intent":"\u003cstring>","pinning":"ioc_pinned","pinnedIocs":[{"type":"\u003cstring>","value":"\u003cstring>"}],"targetProduct":"\u003cstring>","targetLogSource":"\u003cstring>","lifecycleStatus":"authoring"}],"intelItems":[{"id":"\u003cstring>","title":"\u003cstring>","publisher":"\u003cstring>","url":"\u003cstring>","publishedAt":"\u003cstring>","tldr":"\u003cstring>","attackPath":["\u003cstring>"],"sourceName":"\u003cstring>","summary":"\u003cstring>","attackTechniques":[{"id":"\u003cstring>","name":"\u003cstring>"}],"malware":["\u003cstring>"],"actors":["\u003cstring>"],"platforms":["\u003cstring>"],"affectedProducts":[{"name":"\u003cstring>","versions":["\u003cstring>"]}],"eventFirstSeen":"\u003cstring>","eventLastSeen":"\u003cstring>"}],"alerts":[{"id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","displayId":"\u003cstring>","organizationId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","organizationName":"\u003cstring>","title":"\u003cstring>","description":"\u003cstring>","severity":"low","status":"open","duplicateCount":1,"source":{"category":"detection","name":"cotool_detection","triggerType":"jira"},"detection":{"id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","agentId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","ruleId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","name":"\u003cstring>","kind":"cotool","codeDetectionId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","origin":"user"},"createdBy":"agent","originAgentId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originTriggerId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originRunId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originDetectionHitId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","codeDetectionId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originCodeDetectionHitId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","externalProvider":"jira","externalRef":"\u003cstring>","externalUrl":"\u003cstring>","assignedAgentId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","triageRunId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","dedupeKey":"\u003cstring>","createdAt":"\u003cstring>","updatedAt":"\u003cstring>","firstTriagedAt":"\u003cstring>","resolvedAt":"\u003cstring>","derivedDisposition":"true_positive","originAgentName":"\u003cstring>","assignedAgentName":"\u003cstring>","triggerSource":"jira","duplicateOfAlertId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","resolvedByType":"human","resolvedByUserId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","resolvedByAgentName":"\u003cstring>","resolvedReason":"\u003cstring>","huntQualifiedBy":"compromise_signal_found","alternativeExplanationCount":1}],"activeHuntAlert":{"id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","displayId":"\u003cstring>","organizationId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","organizationName":"\u003cstring>","title":"\u003cstring>","description":"\u003cstring>","severity":"low","status":"open","duplicateCount":1,"source":{"category":"detection","name":"cotool_detection","triggerType":"jira"},"detection":{"id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","agentId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","ruleId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","name":"\u003cstring>","kind":"cotool","codeDetectionId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","origin":"user"},"createdBy":"agent","originAgentId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originTriggerId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originRunId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originDetectionHitId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","codeDetectionId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originCodeDetectionHitId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","externalProvider":"jira","externalRef":"\u003cstring>","externalUrl":"\u003cstring>","assignedAgentId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","triageRunId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","dedupeKey":"\u003cstring>","createdAt":"\u003cstring>","updatedAt":"\u003cstring>","firstTriagedAt":"\u003cstring>","resolvedAt":"\u003cstring>","derivedDisposition":"true_positive","originAgentName":"\u003cstring>","assignedAgentName":"\u003cstring>","triggerSource":"jira","duplicateOfAlertId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","resolvedByType":"human","resolvedByUserId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","resolvedByAgentName":"\u003cstring>","resolvedReason":"\u003cstring>","huntQualifiedBy":"compromise_signal_found","alternativeExplanationCount":1},"latestAlert":{"id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","displayId":"\u003cstring>","organizationId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","organizationName":"\u003cstring>","title":"\u003cstring>","description":"\u003cstring>","severity":"low","status":"open","duplicateCount":1,"source":{"category":"detection","name":"cotool_detection","triggerType":"jira"},"detection":{"id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","agentId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","ruleId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","name":"\u003cstring>","kind":"cotool","codeDetectionId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","origin":"user"},"createdBy":"agent","originAgentId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originTriggerId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originRunId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originDetectionHitId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","codeDetectionId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","originCodeDetectionHitId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","externalProvider":"jira","externalRef":"\u003cstring>","externalUrl":"\u003cstring>","assignedAgentId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","triageRunId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","dedupeKey":"\u003cstring>","createdAt":"\u003cstring>","updatedAt":"\u003cstring>","firstTriagedAt":"\u003cstring>","resolvedAt":"\u003cstring>","derivedDisposition":"true_positive","originAgentName":"\u003cstring>","assignedAgentName":"\u003cstring>","triggerSource":"jira","duplicateOfAlertId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","resolvedByType":"human","resolvedByUserId":"3c90c3cc-0d44-4b50-8888-8dd25736052a","resolvedByAgentName":"\u003cstring>","resolvedReason":"\u003cstring>","huntQualifiedBy":"compromise_signal_found","alternativeExplanationCount":1},"activityEvents":[{"id":"\u003cstring>","threatId":"\u003cstring>","kind":"threat_created","actorType":"system","runId":"\u003cstring>","metadata":{"score":123,"hunting":true,"executionId":"\u003cstring>","canonicalKey":"\u003cstring>","label":"\u003cstring>","userId":"\u003cstring>"},"createdAt":"\u003cstring>"}],"capabilities":{"canReadEvidence":true,"canReassess":true,"canTriage":true}}}},"exampleType":"generated"}},"exampleType":"generated"},"4c8b20a1-3789-4215-b1e3-b5b69defe2c1":{"description":"Bad request — input validation failed or the request was malformed","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string","description":"Error message describing what went wrong","isRequired":true,"uniqueKey":"error","typeLabel":"string"},"issues":{"type":"array","description":"Detailed validation issues, present when request or response schema validation fails","items":{"type":"object","additionalProperties":true,"uniqueKey":"issues.items.[INDEX]","typeLabel":"object"},"uniqueKey":"issues","typeLabel":"object[]"}},"required":["error"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":"\u003cstring>","issues":[{}]}}},"exampleType":"generated"}},"exampleType":"generated"},"85c34e1f-e677-4fab-b128-7cb8569749c0":{"description":"Unauthorized — missing or invalid API key / session","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string","description":"Error message describing what went wrong","isRequired":true,"uniqueKey":"error","typeLabel":"string"}},"required":["error"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":"\u003cstring>"}}},"exampleType":"generated"}},"exampleType":"generated"},"08cd5a90-4f9a-4cdd-b72e-25963457bb36":{"description":"Caller lacks the alert.triage permission.","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string","description":"Error message describing what went wrong","isRequired":true,"uniqueKey":"error","typeLabel":"string"}},"required":["error"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":"\u003cstring>"}}},"exampleType":"generated"}},"exampleType":"generated"},"9cd3eaed-f259-4a4e-b847-0bc18d4d8e3b":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string","description":"Error message describing what went wrong","isRequired":true,"uniqueKey":"error","typeLabel":"string"}},"required":["error"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":"\u003cstring>"}}},"exampleType":"generated"}},"exampleType":"generated"}},"security":{"e618135f-d82c-4c86-a175-8e63ddc0cbf3":{"ApiKeyAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key","description":"API Key authentication for programmatic access. Include your API key in the Authorization header as: `Bearer your_api_key_here`","scopes":[],"schemeName":"ApiKeyAuth"}}},"servers":{"f12402bf-094d-4e8f-a6cd-e74cf07b2abe":{"url":"https://app.cotool.ai","description":"Production server"}},"processedSecurityOptions":[{"schemes":[{"scheme":{"type":"http","scheme":"bearer","bearerFormat":"API Key","description":"API Key authentication for programmatic access. Include your API key in the Authorization header as: `Bearer your_api_key_here`","scopes":[],"schemeName":"ApiKeyAuth"},"schema":{"title":"Bearer Auth","type":"string","isRequired":true,"description":"API Key authentication for programmatic access. Include your API key in the Authorization header as: `Bearer your_api_key_here`","format":"bearer","typeLabel":"string\u003cbearer>","deprecated":false},"schemeName":"ApiKeyAuth","name":"Authorization"}],"title":"ApiKeyAuth"}]},"originalFileLocation":"https://app.cotool.ai/api/docs/openapi.json"},"subdomain":"cotool-bcb49c92","siteName":"Cotool Documentation","title":"Restore a dismissed Threat - Cotool Documentation","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-10-21T23:52:33.302Z","originalFileLocation":"api-reference/hunt/restore-a-dismissed-threat.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Clear an explicit dismissal, returning the Threat to its derived status.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Cotool Documentation\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/cotool-bcb49c92/LJnfYfYlhELWbHCE/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/cotool-bcb49c92/LJnfYfYlhELWbHCE/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/cotool-bcb49c92/LJnfYfYlhELWbHCE/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/cotool-bcb49c92/LJnfYfYlhELWbHCE/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/cotool-bcb49c92/LJnfYfYlhELWbHCE/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/cotool-bcb49c92/LJnfYfYlhELWbHCE/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/cotool-bcb49c92/LJnfYfYlhELWbHCE/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/cotool-bcb49c92/LJnfYfYlhELWbHCE/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/cotool-bcb49c92/LJnfYfYlhELWbHCE/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Restore a dismissed Threat - Cotool Documentation\">\u003cmeta data-mint-head property=\"og:description\" content=\"Clear an explicit dismissal, returning the Threat to its derived status.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Cotool Documentation\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.cotool.ai/api-reference/hunt/restore-a-dismissed-threat\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://cotool-bcb49c92.mintlify.app/_mintlify/api/og/v2?division=Hunt\u0026amp;title=Restore+a+dismissed+Threat\u0026amp;description=Clear+an+explicit+dismissal%2C+returning+the+Threat+to+its+derived+status.\u0026amp;theme=cf64d3cca19862b8e8178ed4\u0026amp;signature=cb362df7b6a113024903e89144d15a4b84539fc87615f848607a056a5c7b3a8e\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Restore a dismissed Threat - Cotool Documentation\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Clear an explicit dismissal, returning the Threat to its derived status.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://cotool-bcb49c92.mintlify.app/_mintlify/api/og/v2?division=Hunt\u0026amp;title=Restore+a+dismissed+Threat\u0026amp;description=Clear+an+explicit+dismissal%2C+returning+the+Threat+to+its+derived+status.\u0026amp;theme=cf64d3cca19862b8e8178ed4\u0026amp;signature=cb362df7b6a113024903e89144d15a4b84539fc87615f848607a056a5c7b3a8e\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/cotool-bcb49c92/LJnfYfYlhELWbHCE/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Cotool Documentation\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#A9D5F5\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.cotool.ai/api-reference/hunt/restore-a-dismissed-threat\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/hunt/restore-a-dismissed-threat.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.cotool.ai/#organization\",\"name\":\"Cotool Documentation\",\"url\":\"https://docs.cotool.ai\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/cotool-bcb49c92/2D7q2Y6FoJjh0OqV/logo/light.svg?fit=max\u0026auto=format\u0026n=2D7q2Y6FoJjh0OqV\u0026q=85\u0026s=ed5fa6ba5fadea78cb6d1341380b9873\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.cotool.ai#website\",\"name\":\"Cotool Documentation\",\"url\":\"https://docs.cotool.ai\",\"publisher\":{\"@id\":\"https://docs.cotool.ai/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.cotool.ai/api-reference/hunt/restore-a-dismissed-threat#webpage\",\"url\":\"https://docs.cotool.ai/api-reference/hunt/restore-a-dismissed-threat\",\"name\":\"Restore a dismissed Threat\",\"description\":\"Clear an explicit dismissal, returning the Threat to its derived status.\",\"dateModified\":\"2026-10-21T23:52:33.302Z\",\"isPartOf\":{\"@id\":\"https://docs.cotool.ai#website\"},\"breadcrumb\":{\"@id\":\"https://docs.cotool.ai/api-reference/hunt/restore-a-dismissed-threat#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.cotool.ai/api-reference/hunt/restore-a-dismissed-threat#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Endpoints\",\"item\":\"https://docs.cotool.ai/api-reference/agent-triggers/list-agent-triggers\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hunt\",\"item\":\"https://docs.cotool.ai/api-reference/hunt/hunt-overview\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Restore a dismissed Threat\",\"item\":\"https://docs.cotool.ai/api-reference/hunt/restore-a-dismissed-threat\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.cotool.ai/api-reference/hunt/restore-a-dismissed-threat#apireference\",\"headline\":\"Restore a dismissed Threat\",\"name\":\"Restore a dismissed Threat\",\"description\":\"Clear an explicit dismissal, returning the Threat to its derived status.\",\"url\":\"https://docs.cotool.ai/api-reference/hunt/restore-a-dismissed-threat\",\"mainEntityOfPage\":{\"@id\":\"https://docs.cotool.ai/api-reference/hunt/restore-a-dismissed-threat#webpage\"},\"dateModified\":\"2026-10-21T23:52:33.302Z\",\"publisher\":{\"@id\":\"https://docs.cotool.ai/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.cotool.ai#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Cotool Documentation\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Cotool Documentation","nav":{"global":{"anchors":[{"anchor":"Blog","icon":"newspaper","href":"https://cotool.ai/blog"}]},"tabs":[{"tab":"Documentation","pages":[{"title":"Documentation","href":""}]},{"tab":"API Reference","groups":[{"group":"Overview","pages":[{"title":"API Overview","href":"/api-reference/introduction"}]},{"group":"Endpoints","pages":[{"group":"Agent Triggers","pages":[{"title":"List agent triggers","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}/trigger","href":"/api-reference/agent-triggers/list-agent-triggers"},{"title":"Retrieve an agent trigger secret","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}/trigger/{triggerId}/secret","href":"/api-reference/agent-triggers/retrieve-an-agent-trigger-secret"},{"title":"Update trigger status","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json patch /api/agents/{agentId}/trigger/{triggerId}/status","href":"/api-reference/agent-triggers/update-trigger-status"},{"title":"Update trigger definition","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/agents/{agentId}/trigger/{triggerId}","href":"/api-reference/agent-triggers/update-trigger-definition"},{"title":"Delete trigger","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/agents/{agentId}/trigger/{triggerId}","href":"/api-reference/agent-triggers/delete-trigger"},{"title":"Get webhook fields","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}/trigger/{source}/fields","href":"/api-reference/agent-triggers/get-webhook-fields"},{"title":"Save trigger definition","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agents/{agentId}/trigger/save","href":"/api-reference/agent-triggers/save-trigger-definition"},{"title":"Webhook trigger","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/trigger/{source}/{triggerId}","href":"/api-reference/agent-triggers/webhook-trigger"},{"title":"Create Linear agent session for an agent","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agents/{agentId}/linear/agent-session","href":"/api-reference/agent-triggers/create-linear-agent-session-for-an-agent"},{"title":"Move trigger to another agent","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agents/{agentId}/trigger/{triggerId}/move","href":"/api-reference/agent-triggers/move-trigger-to-another-agent"},{"title":"Get webhook fields for a trigger source","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/trigger-sources/{source}/fields","href":"/api-reference/agent-triggers/get-webhook-fields-for-a-trigger-source"},{"title":"Update trigger event mode","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json patch /api/agents/{agentId}/trigger/{triggerId}/event-mode","href":"/api-reference/agent-triggers/update-trigger-event-mode"}]},{"group":"Chat","pages":[{"title":"Get chat history","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/chat/history","href":"/api-reference/chat/get-chat-history"},{"title":"Get chat metadata","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/chat/meta","href":"/api-reference/chat/get-chat-metadata"},{"title":"List chats","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/chats","href":"/api-reference/chat/list-chats"},{"title":"Submit thumbs feedback for a chat","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/chats/{chatId}/feedback","href":"/api-reference/chat/submit-thumbs-feedback-for-a-chat"},{"title":"Delete chat","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/chats/{chatId}","href":"/api-reference/chat/delete-chat"}]},{"group":"Agents","pages":[{"title":"Run agent asynchronously","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agents/{agentId}/run-async","href":"/api-reference/agents/run-agent-asynchronously"},{"title":"Get async run status (deprecated)","deprecated":true,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}/run-async/{runId}","href":"/api-reference/agents/get-async-run-status-deprecated"},{"title":"Get async run status","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}/run-async/{runId}/status","href":"/api-reference/agents/get-async-run-status"},{"title":"Get async run result","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}/run-async/{runId}/result","href":"/api-reference/agents/get-async-run-result"},{"title":"Run agent synchronously","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agents/{agentId}/run-sync","href":"/api-reference/agents/run-agent-synchronously"},{"title":"List all agents","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents","href":"/api-reference/agents/list-all-agents"},{"title":"Create a new agent","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agents","href":"/api-reference/agents/create-a-new-agent"},{"title":"Get agent","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}","href":"/api-reference/agents/get-agent"},{"title":"Update agent","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/agents/{agentId}","href":"/api-reference/agents/update-agent"},{"title":"Delete agent","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/agents/{agentId}","href":"/api-reference/agents/delete-agent"},{"title":"Convert a disconnected managed agent into a manual agent","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agents/{agentId}/copy","href":"/api-reference/agents/convert-a-disconnected-managed-agent-into-a-manual-agent"},{"title":"Batch update agents","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/agents/batch","href":"/api-reference/agents/batch-update-agents"},{"title":"List agent tags","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agent-tags","href":"/api-reference/agents/list-agent-tags"},{"title":"Create agent tag","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agent-tags","href":"/api-reference/agents/create-agent-tag"},{"title":"Rename agent tag","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/agent-tags/{tagId}","href":"/api-reference/agents/rename-agent-tag"},{"title":"Delete agent tag","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/agent-tags/{tagId}","href":"/api-reference/agents/delete-agent-tag"},{"title":"List agent templates","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agent-templates","href":"/api-reference/agents/list-agent-templates"},{"title":"List agent versions","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}/versions","href":"/api-reference/agents/list-agent-versions"},{"title":"Revert an agent to a previous version","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agents/{agentId}/versions/{versionId}/revert","href":"/api-reference/agents/revert-an-agent-to-a-previous-version"},{"title":"Change agent tag color","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json patch /api/agent-tags/{tagId}/color","href":"/api-reference/agents/change-agent-tag-color"}]},{"group":"Agent Runs","pages":[{"title":"Get response-agent notification defaults","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/response-agent-notification-defaults","href":"/api-reference/agent-runs/get-response-agent-notification-defaults"},{"title":"Update response-agent notification defaults","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/response-agent-notification-defaults","href":"/api-reference/agent-runs/update-response-agent-notification-defaults"},{"title":"List agent runs/chats","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}/chats","href":"/api-reference/agent-runs/list-agent-runschats"},{"title":"List agent runs","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agent-runs","href":"/api-reference/agent-runs/list-agent-runs"},{"title":"List critical issues","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/critical-issues","href":"/api-reference/agent-runs/list-critical-issues"},{"title":"Dismiss critical issue","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/critical-issues/{issueId}/dismiss","href":"/api-reference/agent-runs/dismiss-critical-issue"},{"title":"Submit feedback for an agent run","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agent-runs/{runId}/feedback","href":"/api-reference/agent-runs/submit-feedback-for-an-agent-run"},{"title":"Submit feedback for multiple agent runs","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agent-runs/feedback-batch","href":"/api-reference/agent-runs/submit-feedback-for-multiple-agent-runs"},{"title":"Get detailed feedback metrics for an agent","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}/feedback-metrics","href":"/api-reference/agent-runs/get-detailed-feedback-metrics-for-an-agent"},{"title":"Get LLM evaluation metrics","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agents/{agentId}/llm-eval-metrics","href":"/api-reference/agent-runs/get-llm-evaluation-metrics"},{"title":"Get LLM evaluation metrics for multiple agents","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agents/llm-eval-metrics/batch","href":"/api-reference/agent-runs/get-llm-evaluation-metrics-for-multiple-agents"},{"title":"List trigger sources","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agent-runs/trigger-sources","href":"/api-reference/agent-runs/list-trigger-sources"},{"title":"List output deliveries and notifications for an agent run","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/agent-runs/{runId}/deliveries","href":"/api-reference/agent-runs/list-output-deliveries-and-notifications-for-an-agent-run"},{"title":"Resend a failed output delivery or notification","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agent-runs/{runId}/deliveries/{deliveryId}/resend","href":"/api-reference/agent-runs/resend-a-failed-output-delivery-or-notification"}]},{"group":"Alerts","pages":[{"title":"List alerts","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/alerts","href":"/api-reference/alerts/list-alerts"},{"title":"Get alert filter options","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/alerts/filter-options","href":"/api-reference/alerts/get-alert-filter-options"},{"title":"Get alert routing overview","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/alert-routing","href":"/api-reference/alerts/get-alert-routing-overview"},{"title":"Update default alert routing","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/alert-routing/defaults","href":"/api-reference/alerts/update-default-alert-routing"},{"title":"Get detection alert routing","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/detections/{id}/alert-routing","href":"/api-reference/alerts/get-detection-alert-routing"},{"title":"Get alert for run","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/alerts/for-run/{runId}","href":"/api-reference/alerts/get-alert-for-run"},{"title":"Get alert","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/alerts/{alertId}","href":"/api-reference/alerts/get-alert"},{"title":"Update alert details","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json patch /api/alerts/{alertId}","href":"/api-reference/alerts/update-alert-details"},{"title":"Get alert timeline","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/alerts/{alertId}/timeline","href":"/api-reference/alerts/get-alert-timeline"},{"title":"Get alert source payload","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/alerts/{alertId}/source-payloads/{sourcePayloadId}","href":"/api-reference/alerts/get-alert-source-payload"},{"title":"Add alert comment","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/alerts/{alertId}/comments","href":"/api-reference/alerts/add-alert-comment"},{"title":"Update alert status","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/alerts/{alertId}/status","href":"/api-reference/alerts/update-alert-status"},{"title":"Get escalated alert notification defaults","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/alert-escalation-notification-defaults","href":"/api-reference/alerts/get-escalated-alert-notification-defaults"},{"title":"Update escalated alert notification defaults","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/alert-escalation-notification-defaults","href":"/api-reference/alerts/update-escalated-alert-notification-defaults"},{"title":"Update alert severity","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/alerts/{alertId}/severity","href":"/api-reference/alerts/update-alert-severity"},{"title":"Start alert triage run","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/alerts/{alertId}/triage-runs","href":"/api-reference/alerts/start-alert-triage-run"},{"title":"Update Hunt Alert routing","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/alert-routing/hunt-alerts","href":"/api-reference/alerts/update-hunt-alert-routing"},{"title":"Get alert triage routes","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/alert-triage-routes","href":"/api-reference/alerts/get-alert-triage-routes"},{"title":"Replace alert triage routes","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/alert-triage-routes","href":"/api-reference/alerts/replace-alert-triage-routes"}]},{"group":"Agents as Code","pages":[{"title":"Validate Response-Agent-as-Code YAML","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/agent-sync/validate","href":"/api-reference/agents-as-code/validate-response-agent-as-code-yaml"}]},{"group":"Artifacts","pages":[{"title":"Get artifact","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/artifacts/{artifactId}","href":"/api-reference/artifacts/get-artifact"}]},{"group":"Audit Logs","pages":[{"title":"Count audit logs","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/audit-logs/count","href":"/api-reference/audit-logs/count-audit-logs"},{"title":"Get audit-log filter options","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/audit-logs/filter-options","href":"/api-reference/audit-logs/get-audit-log-filter-options"},{"title":"Get audit-log event catalog","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/audit-logs/event-catalog","href":"/api-reference/audit-logs/get-audit-log-event-catalog"},{"title":"List audit logs","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/audit-logs","href":"/api-reference/audit-logs/list-audit-logs"},{"title":"Get audit log entry","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/audit-logs/{id}","href":"/api-reference/audit-logs/get-audit-log-entry"}]},{"group":"Users","pages":[{"title":"Get current user","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/auth/me","href":"/api-reference/users/get-current-user"},{"title":"Get current user permissions and all available permissions","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/perms","href":"/api-reference/users/get-current-user-permissions-and-all-available-permissions"},{"title":"List user organizations","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/users/organizations","href":"/api-reference/users/list-user-organizations"},{"title":"List users","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/users","href":"/api-reference/users/list-users"},{"title":"Update user","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/users/{id}","href":"/api-reference/users/update-user"},{"title":"Delete user","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/users/{id}","href":"/api-reference/users/delete-user"}]},{"group":"Hunt","pages":[{"title":"Hunt overview","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/hunt/overview","href":"/api-reference/hunt/hunt-overview"},{"title":"List threat actors","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/hunt/actors","href":"/api-reference/hunt/list-threat-actors"},{"title":"List Threats","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/threats","href":"/api-reference/hunt/list-threats"},{"title":"Get Threat detail","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/threats/{id}","href":"/api-reference/hunt/get-threat-detail"},{"title":"Dismiss a Threat","description":"Explicitly dismiss a non-alert Threat (monitoring / covered / clear / blocked / not relevant) with an optional reason. Records who and when. New material positive evidence later auto-restores it.","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/threats/{id}/dismiss","href":"/api-reference/hunt/dismiss-a-threat"},{"title":"Restore a dismissed Threat","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/threats/{id}/restore","href":"/api-reference/hunt/restore-a-dismissed-threat"},{"title":"Reassess a Threat","description":"Manually trigger a fresh Threat-scoped assessment (relevancy gate -> exposure). Enqueues the assessment job; the run streams in the Threat detail activity timeline.","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/threats/{id}/reassess","href":"/api-reference/hunt/reassess-a-threat"},{"title":"Dispose a gap via a threat finding","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/threats/{id}/deliverables/{deliverableId}/gap-status","href":"/api-reference/hunt/dispose-a-gap-via-a-threat-finding"},{"title":"Dispose an observability gap","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/hunt/gaps/{gapId}/status","href":"/api-reference/hunt/dispose-an-observability-gap"},{"title":"Get Hunt Alert creation settings","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/hunt/alert-creation-settings","href":"/api-reference/hunt/get-hunt-alert-creation-settings"},{"title":"Update Hunt Alert creation settings","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/hunt/alert-creation-settings","href":"/api-reference/hunt/update-hunt-alert-creation-settings"}]},{"group":"CLIs","pages":[{"title":"List CLI integrations","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/clis/list","href":"/api-reference/clis/list-cli-integrations"},{"title":"Disconnect CLI","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/clis/{cliType}/disconnect","href":"/api-reference/clis/disconnect-cli"}]},{"group":"Detections","pages":[{"title":"Generate a SIEM query using AI","deprecated":true,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/detection-queries/generate","href":"/api-reference/detections/generate-a-siem-query-using-ai"},{"title":"List detections","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/detections","href":"/api-reference/detections/list-detections"},{"title":"List detection hits","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/detections/hits","href":"/api-reference/detections/list-detection-hits"},{"title":"List the Cotool detection library","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/detection-library","href":"/api-reference/detections/list-the-cotool-detection-library"},{"title":"Read one detection library entry","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/detection-library/{slug}","href":"/api-reference/detections/read-one-detection-library-entry"},{"title":"Add a detection library entry","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/detection-library/{slug}/add","href":"/api-reference/detections/add-a-detection-library-entry"}]},{"group":"Output Destinations","pages":[{"title":"List all output destinations","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/output-destinations","href":"/api-reference/output-destinations/list-all-output-destinations"},{"title":"Create output destination","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/output-destinations","href":"/api-reference/output-destinations/create-output-destination"},{"title":"Update output destination","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/output-destinations/{destinationId}","href":"/api-reference/output-destinations/update-output-destination"},{"title":"Delete output destination","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/output-destinations/{destinationId}","href":"/api-reference/output-destinations/delete-output-destination"},{"title":"Send a test payload to an output destination","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/output-destinations/{destinationId}/test","href":"/api-reference/output-destinations/send-a-test-payload-to-an-output-destination"},{"title":"Send a test payload to an unsaved output destination","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/output-destinations/test","href":"/api-reference/output-destinations/send-a-test-payload-to-an-unsaved-output-destination"},{"title":"Enable or disable output destination","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/output-destinations/{destinationId}/enabled","href":"/api-reference/output-destinations/enable-or-disable-output-destination"}]},{"group":"Roles","pages":[{"title":"List roles for the current organization","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/roles","href":"/api-reference/roles/list-roles-for-the-current-organization"},{"title":"Create a role","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/roles","href":"/api-reference/roles/create-a-role"},{"title":"Get role by id","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/roles/{id}","href":"/api-reference/roles/get-role-by-id"},{"title":"Update a role","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/roles/{id}","href":"/api-reference/roles/update-a-role"},{"title":"Delete a role","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/roles/{id}","href":"/api-reference/roles/delete-a-role"},{"title":"Get permissions for a role","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/roles/{id}/perms","href":"/api-reference/roles/get-permissions-for-a-role"},{"title":"Apply permission diff to a role","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/roles/{id}/perms","href":"/api-reference/roles/apply-permission-diff-to-a-role"}]},{"group":"MITRE Coverage","pages":[{"title":"Get MITRE ATT\u0026CK matrix with detection coverage","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/mitre/matrix","href":"/api-reference/mitre-coverage/get-mitre-att\u0026ck-matrix-with-detection-coverage"},{"title":"Get MITRE ATT\u0026CK technique labels","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/mitre/technique-labels","href":"/api-reference/mitre-coverage/get-mitre-att\u0026ck-technique-labels"}]},{"group":"Organizations","pages":[{"title":"Get organization-level activity metrics","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/org-metrics","href":"/api-reference/organizations/get-organization-level-activity-metrics"}]},{"group":"Skills","pages":[{"title":"List skills","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/skills","href":"/api-reference/skills/list-skills"},{"title":"Create skill","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/skills","href":"/api-reference/skills/create-skill"},{"title":"Get skill","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/skills/{skillId}","href":"/api-reference/skills/get-skill"},{"title":"Update skill","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/skills/{skillId}","href":"/api-reference/skills/update-skill"},{"title":"Delete skill","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/skills/{skillId}","href":"/api-reference/skills/delete-skill"},{"title":"List agents using skill","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/skills/{skillId}/agents","href":"/api-reference/skills/list-agents-using-skill"},{"title":"List skill versions","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/skills/{skillId}/versions","href":"/api-reference/skills/list-skill-versions"},{"title":"Get skill version","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/skills/{skillId}/versions/{versionId}","href":"/api-reference/skills/get-skill-version"},{"title":"Restore a skill version","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/skills/{skillId}/versions/{versionId}/restore","href":"/api-reference/skills/restore-a-skill-version"},{"title":"Import skill","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/skills/import","href":"/api-reference/skills/import-skill"},{"title":"Export skill","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/skills/{skillId}/export","href":"/api-reference/skills/export-skill"}]},{"group":"Tools","pages":[{"title":"List tools","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/tools/list","href":"/api-reference/tools/list-tools"},{"title":"Disconnect tool","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/tools/{toolType}/disconnect","href":"/api-reference/tools/disconnect-tool"},{"title":"Get raw tool output","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/tools/get-tool-use-raw-output","href":"/api-reference/tools/get-raw-tool-output"}]},{"group":"Threat Model","pages":[{"title":"Get threat model","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/threat-model","href":"/api-reference/threat-model/get-threat-model"},{"title":"Update threat model","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/threat-model","href":"/api-reference/threat-model/update-threat-model"},{"title":"Get structured threat model board","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/threat-model/board","href":"/api-reference/threat-model/get-structured-threat-model-board"},{"title":"Regenerate threat model","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/threat-model/regenerate","href":"/api-reference/threat-model/regenerate-threat-model"},{"title":"List threat model version history","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/threat-model/versions","href":"/api-reference/threat-model/list-threat-model-version-history"},{"title":"Get threat model version","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/threat-model/versions/{versionId}","href":"/api-reference/threat-model/get-threat-model-version"}]},{"group":"Intel","pages":[{"title":"List flattened threat-intel indicators (IOCs)","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/intel/iocs","href":"/api-reference/intel/list-flattened-threat-intel-indicators-iocs"},{"title":"List threat intelligence items","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/intel/items","href":"/api-reference/intel/list-threat-intelligence-items"},{"title":"Get specific intel item","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/intel/items/{id}","href":"/api-reference/intel/get-specific-intel-item"},{"title":"Get threat intel notification settings","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/intel/notification-settings","href":"/api-reference/intel/get-threat-intel-notification-settings"},{"title":"Update threat intel notification settings","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/intel/notification-settings","href":"/api-reference/intel/update-threat-intel-notification-settings"},{"title":"List intel sources","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/intel/sources","href":"/api-reference/intel/list-intel-sources"},{"title":"Create intel source","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/intel/sources","href":"/api-reference/intel/create-intel-source"},{"title":"Update intel source","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json put /api/intel/sources/{id}","href":"/api-reference/intel/update-intel-source"},{"title":"Delete intel source","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json delete /api/intel/sources/{id}","href":"/api-reference/intel/delete-intel-source"},{"title":"Trigger intel source sync","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json post /api/intel/sources/{id}/sync","href":"/api-reference/intel/trigger-intel-source-sync"},{"title":"Get intel feed statistics","deprecated":null,"version":null,"openapi":"https://app.cotool.ai/api/docs/openapi.json get /api/intel/stats","href":"/api-reference/intel/get-intel-feed-statistics"}]}]}]},{"tab":"Changelog","pages":[{"title":"Changelog","href":"/changelog"}]}]},"title":"Restore a dismissed Threat - Cotool Documentation","buildId":"dpl_cadrRc5H9XQiJQbDFN5mcYRs2PAj","deploymentId":"dpl_cadrRc5H9XQiJQbDFN5mcYRs2PAj","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-DKJwRUt2.js","utils-CWD_VS3u.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-oFjciODD.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-C76WsxC3.js","snippetPresets-DvPMxpX_.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","ApiExamples-CuNQfndH.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-BVFpVUoF.js","shallow-t59Jg5Kr.js","getApiPlaygroundDisplay-C_JZ4amX.js","CodeSnippet-CLRDnx_h.js","CodeSnippets-C2myU4kc.js","Page-7TwLLapg.js","getPastedJson-B-JaVXw7.js","icon-BA-iDhH3.js","MethodPill-D4qZABFp.js","DuplicateIcon-THIDKO1O.js","createIcon-CYYJwgFd.js","DynamicMarkdown-UGQuxDKp.js","SectionHeading-jYELb23h.js","axios-vUo_bRtp.js","Markdown-DKsLa3wy.js","clsx-CefdjKz2.js","lib--scc4DXi.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-BaREnp3o.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-sgx_0XzF.js"]}