Unavailable. Nobody can download this version any more, with elm or with the Lamdera compiler: github.com/vanhecke/celmex is gone (deleted or private); Software Heritage not asked yet (this run's --swh-calls were used up); no fork with the same repo name found; no cached copy. Use another version.
Cortex behavioral indicators of compromise (BIOCs).
A SearchArgs with no filters, sort, pagination, or
timeframe.
A single BIOC rule.
Top-level envelope returned by list. Not wrapped in the
standard reply.
POST /public_api/v1/bioc/get
Response is top-level {objects_count, objects, objects_type} — NOT wrapped
in the usual reply envelope.
Arguments to insert. items is the raw request_data array
of BIOC objects — each entry must include at least name, type, severity,
status, is_xql, and indicator. The indicator field is the deeply
nested investigation-rule DSL (see Bioc) so the SDK does not type
it ahead of time; callers build the JSON shape themselves and pass it through.
Pass an existing rule_id on an item to upsert that BIOC instead of
inserting a new one.
Outcome of an insert call. addedObjects lists the newly
created BIOC IDs and the server's status string for each; updatedObjects
lists upserts; errors collects per-item failures the server flagged
without aborting the batch.
One row in the InsertResult addedObjects /
updatedObjects arrays — the rule ID the server assigned and the matching
human-readable status it returned.
POST /public_api/v1/bioc/insert — insert or upsert a batch of BIOCs. The response carries the rule IDs of every BIOC the server touched, which a test can use to delete what it inserted.
Arguments to delete. filters is AND-ed server-side; pass
multiple entries to narrow the match further. Build entries via
deleteFilter so the wire shape stays an SDK detail.
One {field, operator, value} predicate accepted by bioc/delete. The
delete endpoint accepts only a constrained operator set (EQ, NEQ, IN,
GTE, LTE) and a closed field set (name, severity, type, is_xql,
comment, status, indicator, mitre_*); the SDK does not validate
either — the server will reject invalid combinations.
Build a DeleteFilter from the raw triple. The
operator should already be one of the API's uppercase keywords (EQ,
NEQ, IN, GTE, LTE); the encoder writes it through verbatim.
Outcome of a delete call. objectsCount is the number of
BIOCs the server removed; objects is the list of rule IDs it removed.
Arguments to
list. All fields are optional; passdefaultSearchArgsfor an unfiltered request.extrais merged last intorequest_dataand overrides any SDK-generated key on collision — e.g.extended_viewis reachable through it.