[{"name":"Cortex.Api.AgentConfig","comment":" Read-only wrappers around the agent configuration GET endpoints under\n`/public_api/v1/configurations/agent/*`. Each one returns a small, flat\nsettings object directly (no `reply` envelope). Source of truth:\n`docs/cortex-api-openapi/agent-configurations-papi.yaml`.\n\n@docs ContentManagement, AutoUpgrade, WildfireAnalysis, CriticalEnvironmentVersions\n@docs AdvancedAnalysis, AgentStatus, InformativeBtpIssues, CortexXdrLogCollection\n@docs ActionCenterExpiration, EndpointAdministrationCleanup\n\n@docs getContentManagement, getAutoUpgrade, getWildfireAnalysis, getCriticalEnvironmentVersions\n@docs getAdvancedAnalysis, getAgentStatus, getInformativeBtpIssues, getCortexXdrLogCollection\n@docs getActionCenterExpiration, getEndpointAdministrationCleanup\n\n","unions":[],"aliases":[{"name":"ActionCenterExpiration","comment":" The action-center-expiration response is an open object whose keys are\naction-type names (e.g. `isolate`, `scan`) and whose values are expiration\ndurations in hours. The OpenAPI schema declares `additionalProperties: integer`,\nso we surface it as a raw `Dict` rather than a fixed record.\n","args":[],"type":"Dict.Dict String.String Basics.Int"},{"name":"AdvancedAnalysis","comment":" Advanced-analysis upload and exception-application toggles.\n","args":[],"type":"{ automaticallyUploadDefinedIssueDataFiles : Maybe.Maybe Basics.Bool, automaticallyApplyAdvancedAnalysisExceptions : Maybe.Maybe Basics.Bool }"},{"name":"AgentStatus","comment":" Timeouts (in days) governing license revocation and agent deletion\nafter lost connection.\n","args":[],"type":"{ licenseRevocationAfterLostConnection : Maybe.Maybe Basics.Int, agentDeletionRetention : Maybe.Maybe Basics.Int }"},{"name":"AutoUpgrade","comment":" Agent auto-upgrade parallelism setting.\n","args":[],"type":"{ amountOfParallelUpgrades : Maybe.Maybe Basics.Int }"},{"name":"ContentManagement","comment":" Content-update bandwidth and minor-version settings.\n","args":[],"type":"{ enableBandwidthControl : Maybe.Maybe Basics.Bool, bandwidthInMbps : Maybe.Maybe Basics.Int, enableMinorContentVersionUpdates : Maybe.Maybe Basics.Bool }"},{"name":"CortexXdrLogCollection","comment":" Master toggle for Cortex XDR agent log collection.\n","args":[],"type":"{ allowLogsCollection : Maybe.Maybe Basics.Bool }"},{"name":"CriticalEnvironmentVersions","comment":" Toggle for the critical-environment-versions enforcement.\n","args":[],"type":"{ enabledCriticalEnvironmentVersions : Maybe.Maybe Basics.Bool }"},{"name":"EndpointAdministrationCleanup","comment":" Periodic duplicate-endpoint cleanup configuration: which identity\nfields to match on, plus the recurrence interval in hours.\n","args":[],"type":"{ periodicDuplicateCleanup : Maybe.Maybe Basics.Bool, hostName : Maybe.Maybe Basics.Bool, ip : Maybe.Maybe Basics.Bool, mac : Maybe.Maybe Basics.Bool, timeIntervalHours : Maybe.Maybe Basics.Int }"},{"name":"InformativeBtpIssues","comment":" Display toggle for informative BTP-rule issues.\n","args":[],"type":"{ displayUniqueAndInformativeBtpRules : Maybe.Maybe Basics.Bool }"},{"name":"WildfireAnalysis","comment":" WildFire scoring toggle for benign verdicts.\n","args":[],"type":"{ enableWildfireAnalysisScoringForBenignVerdicts : Maybe.Maybe Basics.Bool }"}],"values":[{"name":"getActionCenterExpiration","comment":" GET /public\\_api/v1/configurations/agent/action\\_center\\_expiration\n","type":"Cortex.Request.Request Cortex.Api.AgentConfig.ActionCenterExpiration"},{"name":"getAdvancedAnalysis","comment":" GET /public\\_api/v1/configurations/agent/advanced\\_analysis\n","type":"Cortex.Request.Request Cortex.Api.AgentConfig.AdvancedAnalysis"},{"name":"getAgentStatus","comment":" GET /public\\_api/v1/configurations/agent/agent\\_status\n","type":"Cortex.Request.Request Cortex.Api.AgentConfig.AgentStatus"},{"name":"getAutoUpgrade","comment":" GET /public\\_api/v1/configurations/agent/auto\\_upgrade\n","type":"Cortex.Request.Request Cortex.Api.AgentConfig.AutoUpgrade"},{"name":"getContentManagement","comment":" GET /public\\_api/v1/configurations/agent/content\\_management\n","type":"Cortex.Request.Request Cortex.Api.AgentConfig.ContentManagement"},{"name":"getCortexXdrLogCollection","comment":" GET /public\\_api/v1/configurations/agent/cortex\\_xdr\\_log\\_collection\n","type":"Cortex.Request.Request Cortex.Api.AgentConfig.CortexXdrLogCollection"},{"name":"getCriticalEnvironmentVersions","comment":" GET /public\\_api/v1/configurations/agent/critical\\_environment\\_versions\n","type":"Cortex.Request.Request Cortex.Api.AgentConfig.CriticalEnvironmentVersions"},{"name":"getEndpointAdministrationCleanup","comment":" GET /public\\_api/v1/configurations/agent/endpoint\\_administration\\_cleanup\n","type":"Cortex.Request.Request Cortex.Api.AgentConfig.EndpointAdministrationCleanup"},{"name":"getInformativeBtpIssues","comment":" GET /public\\_api/v1/configurations/agent/informative\\_btp\\_issues\n","type":"Cortex.Request.Request Cortex.Api.AgentConfig.InformativeBtpIssues"},{"name":"getWildfireAnalysis","comment":" GET /public\\_api/v1/configurations/agent/wildfire\\_analysis\n","type":"Cortex.Request.Request Cortex.Api.AgentConfig.WildfireAnalysis"}],"binops":[]},{"name":"Cortex.Api.ApiKeys","comment":" Cortex advanced-API key management — list configured keys.\n\n@docs ApiKey, GetApiKeysResponse\n@docs getApiKeys\n\n","unions":[],"aliases":[{"name":"ApiKey","comment":" A single advanced-API key record. Roles are role names, not IDs.\nTime fields are Unix epoch milliseconds.\n","args":[],"type":"{ id : Basics.Int, creationTime : Maybe.Maybe Basics.Int, createdBy : Maybe.Maybe String.String, userName : Maybe.Maybe String.String, roles : List.List String.String, securityLevel : Maybe.Maybe String.String, comment : Maybe.Maybe String.String, expiration : Maybe.Maybe Basics.Int }"},{"name":"GetApiKeysResponse","comment":" Paginated envelope returned by [`getApiKeys`](#getApiKeys): the\nconfigured [`ApiKey`](#ApiKey) records plus the filter / total counts\nfrom the standard Cortex paginated reply.\n","args":[],"type":"{ data : List.List Cortex.Api.ApiKeys.ApiKey, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"}],"values":[{"name":"getApiKeys","comment":" POST /public\\_api/v1/api\\_keys/get\\_api\\_keys\n\nList existing API keys. The API requires a `filters` field; an empty list\nfetches every key. Response uses the standard paginated envelope\n(`DATA`, `FILTER_COUNT`, `TOTAL_COUNT`) inside the `reply` wrapper.\n\n","type":"Cortex.Request.Request Cortex.Api.ApiKeys.GetApiKeysResponse"}],"binops":[]},{"name":"Cortex.Api.AssetGroups","comment":" Cortex asset-group listings.\n\n@docs AssetGroup, AssetGroupsResponse, FilterPart\n@docs list\n\n","unions":[],"aliases":[{"name":"AssetGroup","comment":" One asset group. Field names mirror the wire format's\n`XDM.ASSET_GROUP.*` dotted-uppercase shape.\n","args":[],"type":"{ id : Maybe.Maybe Basics.Int, name : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String, description : Maybe.Maybe String.String, filter : List.List Cortex.Api.AssetGroups.FilterPart, creationTime : Maybe.Maybe Basics.Int, createdBy : Maybe.Maybe String.String, createdByPretty : Maybe.Maybe String.String, lastUpdateTime : Maybe.Maybe Basics.Int, modifiedBy : Maybe.Maybe String.String, modifiedByPretty : Maybe.Maybe String.String, membershipPredicate : Maybe.Maybe Json.Encode.Value, isUsedBySbac : Maybe.Maybe Basics.Bool }"},{"name":"AssetGroupsResponse","comment":" Paginated envelope returned by [`list`](#list).\n","args":[],"type":"{ data : List.List Cortex.Api.AssetGroups.AssetGroup, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"},{"name":"FilterPart","comment":" One render-instruction in an [`AssetGroup`](#AssetGroup)'s filter\ndescription. The filter is emitted as a flat list of parts the UI\nconcatenates (`attribute`, `operator`, `value`, `connector`).\n","args":[],"type":"{ prettyName : Maybe.Maybe String.String, dataType : Maybe.Maybe String.String, renderType : Maybe.Maybe String.String, entityMap : Maybe.Maybe String.String, dmlType : Maybe.Maybe String.String }"}],"values":[{"name":"list","comment":" POST /public\\_api/v1/asset-groups\n\nList configured asset groups on the tenant.\n\n","type":"Cortex.Request.Request Cortex.Api.AssetGroups.AssetGroupsResponse"}],"binops":[]},{"name":"Cortex.Api.Assets","comment":" Cortex asset inventory and external attack-surface views.\n\n@docs SearchArgs, defaultSearchArgs\n@docs AssetsResponse, Asset, AssetCounts\n@docs SchemaEntry\n@docs ExternalService, ExternalServicesResponse\n@docs InternetExposure, InternetExposuresResponse\n@docs ExternalIpRange, ExternalIpRangesResponse\n@docs VulnerabilityTest, AffectedSoftware, VulnerabilityTestsResponse\n@docs ExternalWebsite, ExternalWebsitesResponse\n@docs LastAssessment, WebsitesLastAssessment\n@docs list, getSchema\n@docs getExternalServices, getInternetExposures, getExternalIpRanges\n@docs getVulnerabilityTests, getExternalWebsites, getWebsitesLastAssessment\n\n","unions":[],"aliases":[{"name":"AffectedSoftware","comment":" One affected-software entry under a [`VulnerabilityTest`](#VulnerabilityTest)\n— a CPE plus version range describing which package versions the test\napplies to.\n","args":[],"type":"{ name : Maybe.Maybe String.String, vendor : Maybe.Maybe String.String, product : Maybe.Maybe String.String, version : Maybe.Maybe String.String, versionStartIncluding : Maybe.Maybe String.String, versionStartExcluding : Maybe.Maybe String.String, versionEndIncluding : Maybe.Maybe String.String, versionEndExcluding : Maybe.Maybe String.String }"},{"name":"Asset","comment":" A single asset from the inventory. Field names mirror the wire\nformat's `xdm.asset.*` dotted-lowercase shape.\n","args":[],"type":"{ id : Maybe.Maybe String.String, strongId : Maybe.Maybe String.String, name : Maybe.Maybe String.String, externalProviderId : Maybe.Maybe String.String, provider : Maybe.Maybe String.String, realm : Maybe.Maybe String.String, typeId : Maybe.Maybe String.String, typeName : Maybe.Maybe String.String, typeCategory : Maybe.Maybe String.String, typeClass : Maybe.Maybe String.String, cloudRegion : Maybe.Maybe String.String, firstObserved : Maybe.Maybe Basics.Int, lastObserved : Maybe.Maybe Basics.Int, groupIds : List.List Basics.Int, hostIpv4Addresses : List.List String.String, relatedIssuesCritical : Maybe.Maybe Basics.Int, relatedIssuesBreakdown : Maybe.Maybe Cortex.Api.Assets.AssetCounts, relatedCasesCritical : Maybe.Maybe Basics.Int, relatedCasesBreakdown : Maybe.Maybe Cortex.Api.Assets.AssetCounts }"},{"name":"AssetCounts","comment":" Severity breakdown for an asset's related issues or cases.\n","args":[],"type":"{ critical : Maybe.Maybe Basics.Int, high : Maybe.Maybe Basics.Int, medium : Maybe.Maybe Basics.Int, low : Maybe.Maybe Basics.Int }"},{"name":"AssetsResponse","comment":" Top-level envelope for the asset inventory list.\n","args":[],"type":"{ data : List.List Cortex.Api.Assets.Asset, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"},{"name":"ExternalIpRange","comment":" One external IP-address range registered to or attributed to the\norganization.\n","args":[],"type":"{ rangeId : Maybe.Maybe String.String, firstIp : Maybe.Maybe String.String, lastIp : Maybe.Maybe String.String, ipsCount : Maybe.Maybe Basics.Int, activeResponsiveIpsCount : Maybe.Maybe Basics.Int, dateAdded : Maybe.Maybe Basics.Int, annotations : List.List String.String, organizationHandles : List.List String.String, businessUnits : List.List String.String, tags : List.List String.String }"},{"name":"ExternalIpRangesResponse","comment":" Paginated envelope returned by [`getExternalIpRanges`](#getExternalIpRanges).\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, externalIpAddressRanges : List.List Cortex.Api.Assets.ExternalIpRange }"},{"name":"ExternalService","comment":" A single externally-reachable service (open port + protocol on a\ndiscovered IP). Tenant returned no services on this fixture; full field\nlist is the spec's `external_services` item shape (~20 fields, mostly\noptional). Sub-objects like `details` and `service_classifications` are\npreserved as Encode.Value with inline justification.\n","args":[],"type":"{ serviceId : Maybe.Maybe String.String, serviceName : Maybe.Maybe String.String, serviceType : Maybe.Maybe String.String, ipAddress : List.List String.String, externallyDetectedProviders : List.List String.String, externallyInferredCves : List.List String.String, isActive : Maybe.Maybe String.String, firstObserved : Maybe.Maybe Basics.Int, lastObserved : Maybe.Maybe Basics.Int, protocol : Maybe.Maybe String.String, port_ : Maybe.Maybe Basics.Int, domain : List.List String.String, activeClassifications : List.List String.String, inactiveClassifications : List.List String.String, discoveryType : Maybe.Maybe String.String, businessUnits : List.List String.String, tags : List.List String.String, details : Maybe.Maybe Json.Encode.Value }"},{"name":"ExternalServicesResponse","comment":" Paginated envelope returned by [`getExternalServices`](#getExternalServices).\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, externalServices : List.List Cortex.Api.Assets.ExternalService }"},{"name":"ExternalWebsite","comment":" One externally-reachable website (a URL the ASM engine has\ndiscovered).\n","args":[],"type":"{ id : Maybe.Maybe String.String, url : Maybe.Maybe String.String, statusCode : Maybe.Maybe Basics.Int, title : Maybe.Maybe String.String, favicon : Maybe.Maybe String.String, firstObserved : Maybe.Maybe Basics.Int, lastObserved : Maybe.Maybe Basics.Int, externallyDetectedProviders : List.List String.String, externallyInferredCves : List.List String.String, technologyMatches : List.List String.String, businessUnits : List.List String.String, tags : List.List String.String }"},{"name":"ExternalWebsitesResponse","comment":" Paginated envelope returned by [`getExternalWebsites`](#getExternalWebsites).\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, websites : List.List Cortex.Api.Assets.ExternalWebsite }"},{"name":"InternetExposure","comment":" One internet-exposure record (an asset reachable from the public\ninternet).\n","args":[],"type":"{ assetId : Maybe.Maybe String.String, name : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String, ipAddress : Maybe.Maybe String.String, ipv6Address : Maybe.Maybe String.String, domain : Maybe.Maybe String.String, externallyDetectedProviders : List.List String.String, externallyInferredCves : List.List String.String, externallyInferredVulnerabilityScore : Maybe.Maybe Basics.Float, businessUnits : List.List String.String, firstObserved : Maybe.Maybe Basics.Int, lastObserved : Maybe.Maybe Basics.Int, activeServices : Maybe.Maybe Basics.Int, activeExternalServices : List.List String.String, tags : List.List String.String }"},{"name":"InternetExposuresResponse","comment":" Paginated envelope returned by [`getInternetExposures`](#getInternetExposures).\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, assetsInternetExposure : List.List Cortex.Api.Assets.InternetExposure }"},{"name":"LastAssessment","comment":" Status + timestamp pair used inside [`WebsitesLastAssessment`](#WebsitesLastAssessment).\n","args":[],"type":"{ status : Maybe.Maybe Basics.Bool, time : Maybe.Maybe Basics.Int }"},{"name":"SchemaEntry","comment":" One row of the asset inventory schema returned by [`getSchema`](#getSchema).\n","args":[],"type":"{ fieldName : Maybe.Maybe String.String, fieldPrettyName : Maybe.Maybe String.String, dataType : Maybe.Maybe String.String }"},{"name":"SearchArgs","comment":" Arguments to the filtered asset list endpoints. All fields are\noptional; pass [`defaultSearchArgs`](#defaultSearchArgs) for an unfiltered\nrequest. `extra` is merged last into `request_data` and overrides any\nSDK-generated key on collision.\n","args":[],"type":"{ filters : List.List Cortex.Query.Filter, sort : Maybe.Maybe Cortex.Query.Sort, range : Maybe.Maybe Cortex.Query.Range, timeframe : Maybe.Maybe Cortex.Query.Timeframe, extra : List.List ( String.String, Json.Encode.Value ) }"},{"name":"VulnerabilityTest","comment":" One vulnerability-test definition (a CVE / scanner check the ASM\nengine runs against discovered services).\n","args":[],"type":"{ id : Maybe.Maybe String.String, name : Maybe.Maybe String.String, description : Maybe.Maybe String.String, status : Maybe.Maybe String.String, severityScore : Maybe.Maybe Basics.Float, epssScore : Maybe.Maybe Basics.Float, intrusiveLevel : Maybe.Maybe String.String, countVulnerableServices : Maybe.Maybe Basics.Int, vulnerabilityIds : List.List String.String, vendorNames : List.List String.String, cweIds : List.List String.String, references : List.List String.String, remediationGuidance : Maybe.Maybe String.String, firstPublished : Maybe.Maybe Basics.Int, created : Maybe.Maybe Basics.Int, affectedSoftware : List.List Cortex.Api.Assets.AffectedSoftware }"},{"name":"VulnerabilityTestsResponse","comment":" Paginated envelope returned by [`getVulnerabilityTests`](#getVulnerabilityTests).\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, vulnerabilityTests : List.List Cortex.Api.Assets.VulnerabilityTest }"},{"name":"WebsitesLastAssessment","comment":" Wrapper for the single `last_external_assessment` field returned by\n[`getWebsitesLastAssessment`](#getWebsitesLastAssessment).\n","args":[],"type":"{ lastExternalAssessment : Cortex.Api.Assets.LastAssessment }"}],"values":[{"name":"defaultSearchArgs","comment":" A [`SearchArgs`](#SearchArgs) with no filters, sort, pagination, or\ntimeframe.\n","type":"Cortex.Api.Assets.SearchArgs"},{"name":"getExternalIpRanges","comment":" POST /public\\_api/v1/assets/get\\_external\\_ip\\_address\\_ranges — discovered external IP ranges.\n","type":"Cortex.Api.Assets.SearchArgs -> Cortex.Request.Request Cortex.Api.Assets.ExternalIpRangesResponse"},{"name":"getExternalServices","comment":" POST /public\\_api/v1/assets/get\\_external\\_services — externally reachable services.\n","type":"Cortex.Api.Assets.SearchArgs -> Cortex.Request.Request Cortex.Api.Assets.ExternalServicesResponse"},{"name":"getExternalWebsites","comment":" POST /public\\_api/v1/assets/get\\_external\\_websites — externally reachable websites.\n","type":"Cortex.Api.Assets.SearchArgs -> Cortex.Request.Request Cortex.Api.Assets.ExternalWebsitesResponse"},{"name":"getInternetExposures","comment":" POST /public\\_api/v1/assets/get\\_assets\\_internet\\_exposure — assets exposed to the public internet.\n","type":"Cortex.Api.Assets.SearchArgs -> Cortex.Request.Request Cortex.Api.Assets.InternetExposuresResponse"},{"name":"getSchema","comment":" GET /public\\_api/v1/assets/schema — list the tenant's asset schema.\n","type":"Cortex.Request.Request (List.List Cortex.Api.Assets.SchemaEntry)"},{"name":"getVulnerabilityTests","comment":" POST /public\\_api/v1/assets/get\\_vulnerability\\_tests — vulnerability scanner results.\n","type":"Cortex.Api.Assets.SearchArgs -> Cortex.Request.Request Cortex.Api.Assets.VulnerabilityTestsResponse"},{"name":"getWebsitesLastAssessment","comment":" POST /public\\_api/v1/assets/get\\_external\\_websites/last\\_external\\_assessment —\nstatus + timestamp of the most recent websites scan.\n","type":"Cortex.Request.Request Cortex.Api.Assets.WebsitesLastAssessment"},{"name":"list","comment":" POST /public\\_api/v1/assets — the asset inventory list.\n","type":"Cortex.Request.Request Cortex.Api.Assets.AssetsResponse"}],"binops":[]},{"name":"Cortex.Api.AttackSurface","comment":" Cortex ASM (attack-surface management) rule configuration.\n\n@docs AttackSurfaceRule, RulesResponse\n@docs getRules\n\n","unions":[],"aliases":[{"name":"AttackSurfaceRule","comment":" A single ASM rule row.\n","args":[],"type":"{ attackSurfaceRuleName : Maybe.Maybe String.String, attackSurfaceRuleId : Maybe.Maybe String.String, enabledStatus : Maybe.Maybe String.String, priority : Maybe.Maybe String.String, category : Maybe.Maybe String.String, description : Maybe.Maybe String.String, knowledgeBaseLink : Maybe.Maybe String.String, remediationGuidance : Maybe.Maybe String.String, created : Maybe.Maybe Basics.Int, modified : Maybe.Maybe Basics.Int, modifiedBy : Maybe.Maybe String.String, asmAlertCategories : List.List String.String }"},{"name":"RulesResponse","comment":" Paginated envelope returned by [`getRules`](#getRules).\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, attackSurfaceRules : List.List Cortex.Api.AttackSurface.AttackSurfaceRule }"}],"values":[{"name":"getRules","comment":" POST /public\\_api/v1/get\\_attack\\_surface\\_rules\n\nList configured ASM rules with their enabled status, priority, category,\nremediation guidance, and the alert categories the rule emits into.\n\n","type":"Cortex.Request.Request Cortex.Api.AttackSurface.RulesResponse"}],"binops":[]},{"name":"Cortex.Api.AuditLogs","comment":" Cortex tenant audit-log queries — both human-driven management events\nand agent-emitted reports.\n\nTwo endpoints, two record shapes:\n\n  - [`search`](#search) — management actions (an admin changed a setting,\n    an API key was created, etc.). Records have UPPERCASE-prefixed\n    `AUDIT_*` fields.\n\n  - [`agentsReports`](#agentsReports) — agent-side events (policy updates,\n    scan completions, errors). Records have UPPERCASE field names with\n    floating-point millisecond timestamps.\n\n@docs SearchArgs, defaultSearchArgs\n@docs AuditLog, SearchResponse\n@docs AgentReport, AgentsReportsResponse\n@docs search, agentsReports\n\n","unions":[],"aliases":[{"name":"AgentReport","comment":" A single agent report (an event emitted by an installed XDR agent).\nField names mirror the wire format's UPPERCASE shape. Timestamps are\nemitted as floating-point milliseconds (not integers).\n","args":[],"type":"{ timestamp : Maybe.Maybe Basics.Float, receivedTime : Maybe.Maybe Basics.Float, endpointId : Maybe.Maybe String.String, endpointName : Maybe.Maybe String.String, domain : Maybe.Maybe String.String, category : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String, subType : Maybe.Maybe String.String, severity : Maybe.Maybe String.String, result : Maybe.Maybe String.String, reason : Maybe.Maybe String.String, description : Maybe.Maybe String.String, xdrVersion : Maybe.Maybe String.String }"},{"name":"AgentsReportsResponse","comment":" Paginated envelope returned by [`agentsReports`](#agentsReports).\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, data : List.List Cortex.Api.AuditLogs.AgentReport }"},{"name":"AuditLog","comment":" A single audit-management event (a user/system action against the\ntenant). Field names mirror the wire format's `AUDIT_*` UPPERCASE shape.\n","args":[],"type":"{ auditId : Basics.Int, ownerName : Maybe.Maybe String.String, ownerEmail : Maybe.Maybe String.String, entity : Maybe.Maybe String.String, entitySubtype : Maybe.Maybe String.String, severity : Maybe.Maybe String.String, result : Maybe.Maybe String.String, reason : Maybe.Maybe String.String, description : Maybe.Maybe String.String, insertTime : Maybe.Maybe Basics.Int, hostname : Maybe.Maybe String.String, assetNames : Maybe.Maybe String.String, assetJson : Maybe.Maybe Json.Encode.Value, sessionId : Maybe.Maybe String.String, caseId : Maybe.Maybe Basics.Int, link : Maybe.Maybe String.String, sourceIp : Maybe.Maybe String.String, userAgent : Maybe.Maybe String.String, userRoles : List.List String.String, objectId : Maybe.Maybe String.String }"},{"name":"SearchArgs","comment":" Arguments to [`search`](#search). All fields are optional; pass\n[`defaultSearchArgs`](#defaultSearchArgs) for an unfiltered request. `extra`\nis merged last into `request_data` and overrides any SDK-generated key on\ncollision.\n","args":[],"type":"{ filters : List.List Cortex.Query.Filter, sort : Maybe.Maybe Cortex.Query.Sort, range : Maybe.Maybe Cortex.Query.Range, timeframe : Maybe.Maybe Cortex.Query.Timeframe, extra : List.List ( String.String, Json.Encode.Value ) }"},{"name":"SearchResponse","comment":" Paginated envelope returned by [`search`](#search).\n","args":[],"type":"{ totalCount : Basics.Int, resultCount : Basics.Int, data : List.List Cortex.Api.AuditLogs.AuditLog }"}],"values":[{"name":"agentsReports","comment":" POST /public\\_api/v1/audits/agents\\_reports\n\nRetrieve agent-emitted reports — policy updates, scan completions, error\nnotifications, etc. Each row carries timestamps as floating-point\nmilliseconds.\n\n","type":"Cortex.Request.Request Cortex.Api.AuditLogs.AgentsReportsResponse"},{"name":"defaultSearchArgs","comment":" A [`SearchArgs`](#SearchArgs) with no filters, sort, pagination, or\ntimeframe.\n","type":"Cortex.Api.AuditLogs.SearchArgs"},{"name":"search","comment":" POST /public\\_api/v1/audits/management\\_logs\n\nRetrieve audit management logs. Filters, pagination and timeframe are\ncarried in [`SearchArgs`](#SearchArgs); pass\n[`defaultSearchArgs`](#defaultSearchArgs) to get all results.\n\n","type":"Cortex.Api.AuditLogs.SearchArgs -> Cortex.Request.Request Cortex.Api.AuditLogs.SearchResponse"}],"binops":[]},{"name":"Cortex.Api.AuthSettings","comment":" Cortex tenant IdP/SSO authentication settings.\n\nThe `/public_api/v1/authentication-settings/get/settings` endpoint returns\na list of [`AuthSetting`](#AuthSetting) records — one per configured IdP /\ndomain. Most fields are `Maybe` because populated content varies sharply:\na tenant without SSO configured returns only the SP-side URLs, while a\nfully-configured SAML integration populates the full IdP certificate,\nissuer, SSO URL, and attribute mappings.\n\n@docs AuthSetting, Mappings, AdvancedSettings\n@docs get\n\n","unions":[],"aliases":[{"name":"AdvancedSettings","comment":" Advanced SAML/SP configuration. Optional sub-record under each\n[`AuthSetting`](#AuthSetting).\n","args":[],"type":"{ authnContextEnabled : Maybe.Maybe Basics.Bool, forceAuthn : Maybe.Maybe Json.Encode.Value, idpSingleLogoutUrl : Maybe.Maybe String.String, relayState : Maybe.Maybe String.String, serviceProviderPrivateKey : Maybe.Maybe String.String, serviceProviderPublicCert : Maybe.Maybe String.String }"},{"name":"AuthSetting","comment":" One authentication-settings entry — typically one per configured IdP.\n","args":[],"type":"{ tenantId : Maybe.Maybe String.String, name : Maybe.Maybe String.String, domain : Maybe.Maybe String.String, idpEnabled : Maybe.Maybe Basics.Bool, defaultRole : Maybe.Maybe Json.Encode.Value, isAccountRole : Maybe.Maybe Json.Encode.Value, idpCertificate : Maybe.Maybe String.String, idpIssuer : Maybe.Maybe String.String, idpSsoUrl : Maybe.Maybe String.String, metadataUrl : Maybe.Maybe String.String, mappings : Maybe.Maybe Cortex.Api.AuthSettings.Mappings, advancedSettings : Maybe.Maybe Cortex.Api.AuthSettings.AdvancedSettings, spEntityId : Maybe.Maybe String.String, spLogoutUrl : Maybe.Maybe String.String, spUrl : Maybe.Maybe String.String }"},{"name":"Mappings","comment":" SAML attribute → Cortex field mappings used to populate user records\nduring SSO login.\n","args":[],"type":"{ email : Maybe.Maybe String.String, firstname : Maybe.Maybe String.String, groupName : Maybe.Maybe String.String, lastname : Maybe.Maybe String.String }"}],"values":[{"name":"get","comment":" POST /public\\_api/v1/authentication-settings/get/settings\n\nGet all the authentication settings for every configured domain on the\ntenant. Requires Instance Administrator permissions.\n\n","type":"Cortex.Request.Request (List.List Cortex.Api.AuthSettings.AuthSetting)"}],"binops":[]},{"name":"Cortex.Api.Biocs","comment":" Cortex behavioral indicators of compromise (BIOCs).\n\n@docs SearchArgs, defaultSearchArgs\n@docs Bioc, BiocsResponse\n@docs list\n@docs InsertArgs, InsertResult, BiocChange\n@docs insert\n@docs DeleteArgs, DeleteFilter, deleteFilter, DeleteResult\n@docs delete\n\n","unions":[{"name":"DeleteFilter","comment":" One `{field, operator, value}` predicate accepted by `bioc/delete`. The\ndelete endpoint accepts only a constrained operator set (`EQ`, `NEQ`, `IN`,\n`GTE`, `LTE`) and a closed field set (`name`, `severity`, `type`, `is_xql`,\n`comment`, `status`, `indicator`, `mitre_*`); the SDK does not validate\neither — the server will reject invalid combinations.\n","args":[],"cases":[]}],"aliases":[{"name":"Bioc","comment":" A single BIOC rule.\n","args":[],"type":"{ ruleId : Maybe.Maybe Basics.Int, name : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String, severity : Maybe.Maybe String.String, status : Maybe.Maybe String.String, comment : Maybe.Maybe String.String, isXql : Maybe.Maybe Basics.Bool, mitreTacticIdAndName : List.List String.String, mitreTechniqueIdAndName : List.List String.String, indicator : Maybe.Maybe Json.Encode.Value }"},{"name":"BiocChange","comment":" One row in the [`InsertResult`](#InsertResult) `addedObjects` /\n`updatedObjects` arrays — the rule ID the server assigned and the matching\nhuman-readable status it returned.\n","args":[],"type":"{ id : Basics.Int, status : String.String }"},{"name":"BiocsResponse","comment":" Top-level envelope returned by [`list`](#list). Not wrapped in the\nstandard `reply`.\n","args":[],"type":"{ objectsCount : Maybe.Maybe Basics.Int, objects : List.List Cortex.Api.Biocs.Bioc, objectsType : Maybe.Maybe String.String }"},{"name":"DeleteArgs","comment":" Arguments to [`delete`](#delete). `filters` is AND-ed server-side; pass\nmultiple entries to narrow the match further. Build entries via\n[`deleteFilter`](#deleteFilter) so the wire shape stays an SDK detail.\n","args":[],"type":"{ filters : List.List Cortex.Api.Biocs.DeleteFilter }"},{"name":"DeleteResult","comment":" Outcome of a [`delete`](#delete) call. `objectsCount` is the number of\nBIOCs the server removed; `objects` is the list of rule IDs it removed.\n","args":[],"type":"{ objectsCount : Basics.Int, objects : List.List Basics.Int }"},{"name":"InsertArgs","comment":" Arguments to [`insert`](#insert). `items` is the raw `request_data` array\nof BIOC objects — each entry must include at least `name`, `type`, `severity`,\n`status`, `is_xql`, and `indicator`. The `indicator` field is the deeply\nnested investigation-rule DSL (see [`Bioc`](#Bioc)) so the SDK does not type\nit ahead of time; callers build the JSON shape themselves and pass it through.\nPass an existing `rule_id` on an item to upsert that BIOC instead of\ninserting a new one.\n","args":[],"type":"{ items : Json.Encode.Value }"},{"name":"InsertResult","comment":" Outcome of an [`insert`](#insert) call. `addedObjects` lists the newly\ncreated BIOC IDs and the server's status string for each; `updatedObjects`\nlists upserts; `errors` collects per-item failures the server flagged\nwithout aborting the batch.\n","args":[],"type":"{ addedObjects : List.List Cortex.Api.Biocs.BiocChange, updatedObjects : List.List Cortex.Api.Biocs.BiocChange, errors : List.List String.String }"},{"name":"SearchArgs","comment":" Arguments to [`list`](#list). All fields are optional; pass\n[`defaultSearchArgs`](#defaultSearchArgs) for an unfiltered request. `extra`\nis merged last into `request_data` and overrides any SDK-generated key on\ncollision — e.g. `extended_view` is reachable through it.\n","args":[],"type":"{ filters : List.List Cortex.Query.Filter, sort : Maybe.Maybe Cortex.Query.Sort, range : Maybe.Maybe Cortex.Query.Range, timeframe : Maybe.Maybe Cortex.Query.Timeframe, extra : List.List ( String.String, Json.Encode.Value ) }"}],"values":[{"name":"defaultSearchArgs","comment":" A [`SearchArgs`](#SearchArgs) with no filters, sort, pagination, or\ntimeframe.\n","type":"Cortex.Api.Biocs.SearchArgs"},{"name":"delete","comment":" POST /public\\_api/v1/bioc/delete — remove every BIOC matching the\nfilters.\n","type":"Cortex.Api.Biocs.DeleteArgs -> Cortex.Request.Request Cortex.Api.Biocs.DeleteResult"},{"name":"deleteFilter","comment":" Build a [`DeleteFilter`](#DeleteFilter) from the raw triple. The\n`operator` should already be one of the API's uppercase keywords (`EQ`,\n`NEQ`, `IN`, `GTE`, `LTE`); the encoder writes it through verbatim.\n","type":"{ field : String.String, operator : String.String, value : Json.Encode.Value } -> Cortex.Api.Biocs.DeleteFilter"},{"name":"insert","comment":" POST /public\\_api/v1/bioc/insert — insert or upsert a batch of BIOCs.\nThe response carries the rule IDs of every BIOC the server touched, which a\ntest can use to delete what it inserted.\n","type":"Cortex.Api.Biocs.InsertArgs -> Cortex.Request.Request Cortex.Api.Biocs.InsertResult"},{"name":"list","comment":" POST /public\\_api/v1/bioc/get\n\nResponse is top-level `{objects_count, objects, objects_type}` — NOT wrapped\nin the usual `reply` envelope.\n\n","type":"Cortex.Api.Biocs.SearchArgs -> Cortex.Request.Request Cortex.Api.Biocs.BiocsResponse"}],"binops":[]},{"name":"Cortex.Api.Cases","comment":" Cortex case search — incident-level groupings of issues.\n\n@docs SearchArgs, defaultSearchArgs\n@docs Case, SearchResponse\n@docs search\n\n","unions":[],"aliases":[{"name":"Case","comment":" A single case (incident-level grouping of related issues).\n","args":[],"type":"{ caseId : Maybe.Maybe Basics.Int, caseName : Maybe.Maybe String.String, description : Maybe.Maybe String.String, severity : Maybe.Maybe String.String, statusProgress : Maybe.Maybe String.String, resolveReason : Maybe.Maybe String.String, resolveComment : Maybe.Maybe String.String, isBlocked : Maybe.Maybe Basics.Bool, starred : Maybe.Maybe Basics.Bool, creationTime : Maybe.Maybe Basics.Int, modificationTime : Maybe.Maybe Basics.Int, resolvedTimestamp : Maybe.Maybe Basics.Int, assignedUserMail : Maybe.Maybe String.String, assignedUserPrettyName : Maybe.Maybe String.String, issueCount : Maybe.Maybe Basics.Int, lowSeverityIssueCount : Maybe.Maybe Basics.Int, medSeverityIssueCount : Maybe.Maybe Basics.Int, highSeverityIssueCount : Maybe.Maybe Basics.Int, criticalSeverityIssueCount : Maybe.Maybe Basics.Int, userCount : Maybe.Maybe Basics.Int, hostCount : Maybe.Maybe Basics.Int, wildfireHits : Maybe.Maybe Basics.Int, aggregatedScore : Maybe.Maybe Basics.Int, xdrUrl : Maybe.Maybe String.String, caseDomain : Maybe.Maybe String.String, hosts : List.List String.String, users : List.List String.String, issueCategories : List.List String.String, tags : List.List String.String, issueIds : List.List Basics.Int, assetIds : List.List String.String, assets : List.List String.String, mitreTacticsIdsAndNames : List.List String.String, mitreTechniquesIdsAndNames : List.List String.String, customFields : Maybe.Maybe Json.Encode.Value }"},{"name":"SearchArgs","comment":" Arguments to [`search`](#search). All fields are optional; pass\n[`defaultSearchArgs`](#defaultSearchArgs) for an unfiltered request. `extra`\nis merged last into `request_data` and overrides any SDK-generated key on\ncollision — use it to reach fields the SDK has not modeled yet.\n","args":[],"type":"{ filters : List.List Cortex.Query.Filter, sort : Maybe.Maybe Cortex.Query.Sort, range : Maybe.Maybe Cortex.Query.Range, timeframe : Maybe.Maybe Cortex.Query.Timeframe, extra : List.List ( String.String, Json.Encode.Value ) }"},{"name":"SearchResponse","comment":" Paginated envelope returned by [`search`](#search).\n","args":[],"type":"{ data : List.List Cortex.Api.Cases.Case, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"}],"values":[{"name":"defaultSearchArgs","comment":" A [`SearchArgs`](#SearchArgs) with no filters, sort, pagination, or\ntimeframe — equivalent to an unfiltered search.\n","type":"Cortex.Api.Cases.SearchArgs"},{"name":"search","comment":" POST /public\\_api/v1/case/search\n\nSearch cases with optional filters, sorting, pagination, and timeframe.\n\n","type":"Cortex.Api.Cases.SearchArgs -> Cortex.Request.Request Cortex.Api.Cases.SearchResponse"}],"binops":[]},{"name":"Cortex.Api.Cli","comment":" Latest Cortex CLI version announced by the tenant.\n\n@docs VersionResponse\n@docs getVersion\n\n","unions":[],"aliases":[{"name":"VersionResponse","comment":" Latest published CLI version string returned by [`getVersion`](#getVersion).\n","args":[],"type":"{ version : String.String }"}],"values":[{"name":"getVersion","comment":" GET /public\\_api/v1/cli/releases/version\n\nGet the latest version of the Cortex CLI.\n\n","type":"Cortex.Request.Request Cortex.Api.Cli.VersionResponse"}],"binops":[]},{"name":"Cortex.Api.Correlations","comment":" Cortex correlation rules — XQL queries that produce alerts on a\nschedule or in real time.\n\n@docs SearchArgs, defaultSearchArgs\n@docs Correlation, CorrelationsResponse\n@docs get\n@docs InsertArgs, InsertResult, CorrelationChange, CorrelationError\n@docs insert\n@docs DeleteArgs, DeleteFilter, deleteFilter, DeleteResult\n@docs delete\n\n","unions":[{"name":"DeleteFilter","comment":" One `{field, operator, value}` predicate accepted by\n`correlations/delete`. The delete endpoint accepts the operator set\n(`EQ`, `IN`, `GTE`, `LTE`) over a closed field set including `name`,\n`severity`, `xql_query`, `is_enabled`, and the alert / scheduling /\nsuppression keys; the SDK does not validate either — the server will\nreject invalid combinations.\n","args":[],"cases":[]}],"aliases":[{"name":"Correlation","comment":" A single correlation rule.\n","args":[],"type":"{ id : Maybe.Maybe Basics.Int, name : Maybe.Maybe String.String, description : Maybe.Maybe String.String, severity : Maybe.Maybe String.String, isEnabled : Maybe.Maybe String.String, xqlQuery : Maybe.Maybe String.String, dataset : Maybe.Maybe String.String, executionMode : Maybe.Maybe String.String, searchWindow : Maybe.Maybe String.String, simpleSchedule : Maybe.Maybe String.String, crontab : Maybe.Maybe String.String, timezone : Maybe.Maybe String.String, suppressionEnabled : Maybe.Maybe Basics.Bool, suppressionDuration : Maybe.Maybe String.String, suppressionFields : List.List String.String, alertName : Maybe.Maybe String.String, alertCategory : Maybe.Maybe String.String, alertDescription : Maybe.Maybe String.String, alertDomain : Maybe.Maybe String.String, alertFields : Maybe.Maybe Json.Encode.Value, userDefinedSeverity : Maybe.Maybe String.String, userDefinedCategory : Maybe.Maybe String.String, mitreDefs : Maybe.Maybe Json.Encode.Value, investigationQueryLink : Maybe.Maybe String.String, drilldownQueryTimeframe : Maybe.Maybe String.String, mappingStrategy : Maybe.Maybe String.String }"},{"name":"CorrelationChange","comment":" One row in the [`InsertResult`](#InsertResult) `addedObjects` /\n`updatedObjects` arrays — the rule ID the server assigned and the matching\nhuman-readable status it returned.\n","args":[],"type":"{ id : Basics.Int, status : String.String }"},{"name":"CorrelationError","comment":" One row in the [`InsertResult`](#InsertResult) `errors` array — the\nzero-based index of the offending item in the request and the server's\nhuman-readable rejection reason.\n","args":[],"type":"{ index : Basics.Int, status : String.String }"},{"name":"CorrelationsResponse","comment":" Top-level envelope returned by [`get`](#get). Not wrapped in the\nstandard `reply`.\n","args":[],"type":"{ objectsCount : Maybe.Maybe Basics.Int, objects : List.List Cortex.Api.Correlations.Correlation, objectsType : Maybe.Maybe String.String }"},{"name":"DeleteArgs","comment":" Arguments to [`delete`](#delete). `filters` is AND-ed server-side; pass\nmultiple entries to narrow the match further. Build entries via\n[`deleteFilter`](#deleteFilter) so the wire shape stays an SDK detail.\n","args":[],"type":"{ filters : List.List Cortex.Api.Correlations.DeleteFilter }"},{"name":"DeleteResult","comment":" Outcome of a [`delete`](#delete) call. `objectsCount` is the number of\nrules the server removed; `objects` is the list of rule IDs it removed.\n","args":[],"type":"{ objectsCount : Basics.Int, objects : List.List Basics.Int }"},{"name":"InsertArgs","comment":" Arguments to [`insert`](#insert). `items` is the raw `request_data` array\nof correlation-rule objects. The live API requires a much larger field set\nthan the published OpenAPI spec marks as optional (every scheduling /\nsuppression / MITRE field plus a few undocumented ones), so the SDK does\nnot type the item shape — callers supply the JSON they want sent. Pass an\nexisting `rule_id` on an item to upsert that rule instead of inserting a\nnew one.\n","args":[],"type":"{ items : Json.Encode.Value }"},{"name":"InsertResult","comment":" Outcome of an [`insert`](#insert) call. `addedObjects` lists the newly\ncreated rule IDs and the server's status string for each; `updatedObjects`\nlists upserts; `errors` collects per-item failures the server flagged\nwithout aborting the batch.\n","args":[],"type":"{ addedObjects : List.List Cortex.Api.Correlations.CorrelationChange, updatedObjects : List.List Cortex.Api.Correlations.CorrelationChange, errors : List.List Cortex.Api.Correlations.CorrelationError }"},{"name":"SearchArgs","comment":" Arguments to [`get`](#get). All fields are optional; pass\n[`defaultSearchArgs`](#defaultSearchArgs) for an unfiltered request. `extra`\nis merged last into `request_data` and overrides any SDK-generated key on\ncollision.\n","args":[],"type":"{ filters : List.List Cortex.Query.Filter, sort : Maybe.Maybe Cortex.Query.Sort, range : Maybe.Maybe Cortex.Query.Range, timeframe : Maybe.Maybe Cortex.Query.Timeframe, extra : List.List ( String.String, Json.Encode.Value ) }"}],"values":[{"name":"defaultSearchArgs","comment":" A [`SearchArgs`](#SearchArgs) with no filters, sort, pagination, or\ntimeframe.\n","type":"Cortex.Api.Correlations.SearchArgs"},{"name":"delete","comment":" POST /public\\_api/v1/correlations/delete — remove every correlation\nrule matching the filters.\n","type":"Cortex.Api.Correlations.DeleteArgs -> Cortex.Request.Request Cortex.Api.Correlations.DeleteResult"},{"name":"deleteFilter","comment":" Build a [`DeleteFilter`](#DeleteFilter) from the raw triple. The\n`operator` should already be one of the API's uppercase keywords (`EQ`,\n`IN`, `GTE`, `LTE`); the encoder writes it through verbatim.\n","type":"{ field : String.String, operator : String.String, value : Json.Encode.Value } -> Cortex.Api.Correlations.DeleteFilter"},{"name":"get","comment":" POST /public\\_api/v1/correlations/get\n\nResponse is top-level `{objects_count, objects, objects_type}` — NOT wrapped\nin the usual `reply` envelope.\n\n","type":"Cortex.Api.Correlations.SearchArgs -> Cortex.Request.Request Cortex.Api.Correlations.CorrelationsResponse"},{"name":"insert","comment":" POST /public\\_api/v1/correlations/insert — insert or upsert a batch of\ncorrelation rules. The response carries the rule IDs of every rule the\nserver touched, which a test can use to delete what it inserted.\n","type":"Cortex.Api.Correlations.InsertArgs -> Cortex.Request.Request Cortex.Api.Correlations.InsertResult"}],"binops":[]},{"name":"Cortex.Api.DeviceControl","comment":" Cortex device-control policy violations — events where a peripheral\ndevice (USB stick, optical drive, etc.) was blocked by an endpoint policy.\n\n@docs ViolationsResponse, Violation\n@docs getViolations\n\n","unions":[],"aliases":[{"name":"Violation","comment":" A single device-control violation — a peripheral that was blocked\non an endpoint by policy. Every field is `Maybe` because the API may\nomit fields that are not relevant to the violation type (e.g.\n`product_id` may be empty for unidentified devices).\n","args":[],"type":"{ violationId : Maybe.Maybe Basics.Int, timestamp : Maybe.Maybe Basics.Int, type_ : Maybe.Maybe String.String, hostname : Maybe.Maybe String.String, username : Maybe.Maybe String.String, ip : Maybe.Maybe String.String, endpointId : Maybe.Maybe String.String, vendor : Maybe.Maybe String.String, vendorId : Maybe.Maybe String.String, product : Maybe.Maybe String.String, productId : Maybe.Maybe String.String, serial : Maybe.Maybe String.String }"},{"name":"ViolationsResponse","comment":" Paginated envelope returned by [`getViolations`](#getViolations).\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, violations : List.List Cortex.Api.DeviceControl.Violation }"}],"values":[{"name":"getViolations","comment":" POST /public\\_api/v1/device\\_control/get\\_violations\n\nGet device-control violations matching the optional filters in\n`request_data`. An empty body returns up to 100 results.\n\n","type":"Cortex.Request.Request Cortex.Api.DeviceControl.ViolationsResponse"}],"binops":[]},{"name":"Cortex.Api.DisablePrevention","comment":" Cortex disable-prevention rules — exceptions that disable a specific\nprevention module from running on selected processes / files / hashes.\n\nThree endpoints:\n\n  - [`fetchRules`](#fetchRules) — list configured disable-prevention rules.\n  - [`fetchInjectionRules`](#fetchInjectionRules) — same shape, for the\n    injection-prevention sibling resource.\n  - [`getModules`](#getModules) — list disable-able modules for a given\n    platform.\n\n@docs Response, Rule, Module\n@docs fetchRules, fetchInjectionRules, getModules\n\n","unions":[],"aliases":[{"name":"Module","comment":" One disable-able module type returned by [`getModules`](#getModules).\n","args":[],"type":"{ moduleId : Maybe.Maybe Basics.Int, name : Maybe.Maybe String.String, description : Maybe.Maybe String.String, profileType : Maybe.Maybe String.String, conditionsDefinition : Maybe.Maybe Json.Encode.Value }"},{"name":"Response","comment":" Paginated envelope for both [`fetchRules`](#fetchRules) and\n[`fetchInjectionRules`](#fetchInjectionRules).\n","args":[],"type":"{ data : List.List Cortex.Api.DisablePrevention.Rule, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"},{"name":"Rule","comment":" A single disable-prevention (or disable-injection-prevention) rule.\n","args":[],"type":"{ ruleId : Maybe.Maybe String.String, ruleName : Maybe.Maybe String.String, description : Maybe.Maybe String.String, platform : Maybe.Maybe String.String, conditions : Maybe.Maybe Json.Encode.Value, moduleIds : List.List Basics.Int, profileIds : List.List Basics.Int, scope : Maybe.Maybe String.String, status : Maybe.Maybe String.String, createdBy : Maybe.Maybe String.String, userEmail : Maybe.Maybe String.String, modificationTime : Maybe.Maybe Basics.Int, associatedTargets : List.List String.String }"}],"values":[{"name":"fetchInjectionRules","comment":" POST /public\\_api/v1/disable\\_injection\\_prevention\\_rules/fetch\n","type":"Cortex.Request.Request Cortex.Api.DisablePrevention.Response"},{"name":"fetchRules","comment":" POST /public\\_api/v1/disable\\_prevention/fetch\n","type":"Cortex.Request.Request Cortex.Api.DisablePrevention.Response"},{"name":"getModules","comment":" POST /public\\_api/v1/disable\\_prevention/get\\_modules\n\n`platform` must be `windows`, `linux`, or `macos` (lowercase).\n\n","type":"String.String -> Cortex.Request.Request (List.List Cortex.Api.DisablePrevention.Module)"}],"binops":[]},{"name":"Cortex.Api.Distributions","comment":" Cortex agent installer distributions and available versions.\n\n@docs Distribution, DistributionsResponse, Versions\n@docs DistributionStatus, DistributionUrl\n@docs getDistributions, getVersions\n@docs getStatus, getDistUrl\n\n","unions":[],"aliases":[{"name":"Distribution","comment":" A single agent installer distribution.\n","args":[],"type":"{ distributionId : Maybe.Maybe String.String, name : Maybe.Maybe String.String, description : Maybe.Maybe String.String, packageType : Maybe.Maybe String.String, platform : Maybe.Maybe String.String, agentVersion : Maybe.Maybe String.String, status : Maybe.Maybe String.String, tags : List.List String.String, eolTime : Maybe.Maybe Basics.Int, createdBy : Maybe.Maybe String.String, creationTime : Maybe.Maybe Basics.Int, modificationTime : Maybe.Maybe Basics.Int, supportedPackages : List.List String.String }"},{"name":"DistributionStatus","comment":" Build status of a distribution package, returned by [`getStatus`](#getStatus).\n","args":[],"type":"{ status : Maybe.Maybe String.String }"},{"name":"DistributionUrl","comment":" Signed download URL for a distribution package, returned by [`getDistUrl`](#getDistUrl).\n","args":[],"type":"{ distributionUrl : Maybe.Maybe String.String }"},{"name":"DistributionsResponse","comment":" Paginated envelope returned by [`getDistributions`](#getDistributions).\n","args":[],"type":"{ data : List.List Cortex.Api.Distributions.Distribution, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"},{"name":"Versions","comment":" The OpenAPI spec only documents `windows`, `linux`, and `macos`, but the\nlive tenant also returns `container` and `serverless` arrays. Per CLAUDE.md\nwe capture every field the API returns.\n","args":[],"type":"{ windows : List.List String.String, linux : List.List String.String, macos : List.List String.String, container : List.List String.String, serverless : List.List String.String }"}],"values":[{"name":"getDistUrl","comment":" POST /public\\_api/v1/distributions/get\\_dist\\_url\n\n`packageType` must match the platform of the distribution. Valid values include\n`pkg` (macOS), `x86`/`x64`/`arm` (Windows), and `sh`/`rpm`/`deb` (Linux). The\n[`Distribution`](#Distribution) record's `supportedPackages` field lists the\nvalid choices for a given distribution.\n\n","type":"{ distributionId : String.String, packageType : String.String } -> Cortex.Request.Request Cortex.Api.Distributions.DistributionUrl"},{"name":"getDistributions","comment":" POST /public\\_api/v1/distributions/get\\_distributions\n","type":"Cortex.Request.Request Cortex.Api.Distributions.DistributionsResponse"},{"name":"getStatus","comment":" POST /public\\_api/v1/distributions/get\\_status\n","type":"String.String -> Cortex.Request.Request Cortex.Api.Distributions.DistributionStatus"},{"name":"getVersions","comment":" POST /public\\_api/v1/distributions/get\\_versions\n","type":"Cortex.Request.Request Cortex.Api.Distributions.Versions"}],"binops":[]},{"name":"Cortex.Api.Endpoints","comment":" Cortex endpoint inventory.\n\n@docs SearchArgs, defaultSearchArgs\n@docs Endpoint, EndpointTags, ListResponse\n@docs list\n\n","unions":[],"aliases":[{"name":"Endpoint","comment":" A single Cortex endpoint (managed host running an agent).\n","args":[],"type":"{ agentId : String.String, agentStatus : Maybe.Maybe String.String, operationalStatus : Maybe.Maybe String.String, hostName : Maybe.Maybe String.String, agentType : Maybe.Maybe String.String, ip : List.List String.String, lastSeen : Maybe.Maybe Basics.Int, tags : Maybe.Maybe Cortex.Api.Endpoints.EndpointTags, users : List.List String.String }"},{"name":"EndpointTags","comment":" The two tag buckets attached to an [`Endpoint`](#Endpoint) — one for\nserver-applied tags and one for endpoint-applied tags. The wire format\nemits each as a list of strings (the spec's `items: { type: object }` is\nlooser than the live response).\n","args":[],"type":"{ serverTags : List.List String.String, endpointTags : List.List String.String }"},{"name":"ListResponse","comment":" Envelope wrapping the endpoint list returned by [`list`](#list).\n","args":[],"type":"{ endpoints : List.List Cortex.Api.Endpoints.Endpoint }"},{"name":"SearchArgs","comment":" Arguments to [`list`](#list). All fields are optional; pass\n[`defaultSearchArgs`](#defaultSearchArgs) for an unfiltered request. `extra`\nis merged last into `request_data` and overrides any SDK-generated key on\ncollision.\n","args":[],"type":"{ filters : List.List Cortex.Query.Filter, sort : Maybe.Maybe Cortex.Query.Sort, range : Maybe.Maybe Cortex.Query.Range, timeframe : Maybe.Maybe Cortex.Query.Timeframe, extra : List.List ( String.String, Json.Encode.Value ) }"}],"values":[{"name":"defaultSearchArgs","comment":" A [`SearchArgs`](#SearchArgs) with no filters, sort, pagination, or\ntimeframe — equivalent to listing every endpoint on the tenant.\n","type":"Cortex.Api.Endpoints.SearchArgs"},{"name":"list","comment":" POST /public\\_api/v1/endpoints/get\\_endpoints\n\nRetrieve a filtered list of endpoints (agents) on the tenant. Response uses\nthe `reply` envelope containing a flat array.\n\n","type":"Cortex.Api.Endpoints.SearchArgs -> Cortex.Request.Request Cortex.Api.Endpoints.ListResponse"}],"binops":[]},{"name":"Cortex.Api.Healthcheck","comment":" Lightweight tenant reachability probe.\n\n@docs HealthcheckResponse\n@docs check\n\n","unions":[],"aliases":[{"name":"HealthcheckResponse","comment":" Single-field status response returned by [`check`](#check).\n","args":[],"type":"{ status : String.String }"}],"values":[{"name":"check","comment":" GET /public\\_api/v1/healthcheck\n\nPerform a health check of the Cortex environment.\nReturns a simple status string (e.g. \"available\").\n\n","type":"Cortex.Request.Request Cortex.Api.Healthcheck.HealthcheckResponse"}],"binops":[]},{"name":"Cortex.Api.Indicators","comment":" Cortex threat intelligence indicators (IOCs).\n\n@docs SearchArgs, defaultSearchArgs\n@docs Indicator, IndicatorsResponse\n@docs get\n@docs InsertArgs, InsertResult, IndicatorChange, IndicatorError\n@docs insert\n@docs DeleteArgs, DeleteFilter, deleteFilter, DeleteResult\n@docs delete\n\n","unions":[{"name":"DeleteFilter","comment":" One `{field, operator, value}` predicate accepted by `indicators/delete`.\nThe delete endpoint accepts only a constrained operator set (`EQ`, `NEQ`,\n`IN`, `GTE`, `LTE`) and a closed field set (`indicator`, `type`, `severity`,\n`expiration_date`, `default_expiration_enabled`, `comment`, `reputation`,\n`reliability`); the SDK does not validate either — the server will reject\ninvalid combinations.\n","args":[],"cases":[]}],"aliases":[{"name":"DeleteArgs","comment":" Arguments to [`delete`](#delete). `filters` is AND-ed server-side; pass\nmultiple entries to narrow the match further. Build entries via\n[`deleteFilter`](#deleteFilter) so the wire shape stays an SDK detail.\n","args":[],"type":"{ filters : List.List Cortex.Api.Indicators.DeleteFilter }"},{"name":"DeleteResult","comment":" Outcome of a [`delete`](#delete) call. `objectsCount` is the number of\nIOCs the server removed; `objects` is the list of rule IDs it removed.\n","args":[],"type":"{ objectsCount : Basics.Int, objects : List.List Basics.Int }"},{"name":"Indicator","comment":" A single threat-intelligence indicator (hash, domain, URL, IP, etc.).\n","args":[],"type":"{ ruleId : Maybe.Maybe Basics.Int, indicator : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String, severity : Maybe.Maybe String.String, expirationDate : Maybe.Maybe Basics.Int, defaultExpirationEnabled : Maybe.Maybe Basics.Bool, comment : Maybe.Maybe String.String, reputation : Json.Encode.Value, reliability : Json.Encode.Value }"},{"name":"IndicatorChange","comment":" One row in the [`InsertResult`](#InsertResult) `addedObjects` /\n`updatedObjects` arrays — the rule ID the server assigned and the matching\nhuman-readable status it returned.\n","args":[],"type":"{ id : Basics.Int, status : String.String }"},{"name":"IndicatorError","comment":" One row in the [`InsertResult`](#InsertResult) `errors` array — the\nzero-based index of the offending item in the request and the server's\nhuman-readable rejection reason.\n","args":[],"type":"{ index : Basics.Int, status : String.String }"},{"name":"IndicatorsResponse","comment":" Envelope returned by [`get`](#get). Not wrapped in the standard `reply`.\n","args":[],"type":"{ objectsCount : Maybe.Maybe Basics.Int, objects : List.List Cortex.Api.Indicators.Indicator, objectsType : Maybe.Maybe String.String }"},{"name":"InsertArgs","comment":" Arguments to [`insert`](#insert). `items` is the raw `request_data` array\nof indicator objects — each entry must include at least `indicator`, `type`,\n`severity`, and `comment`. The optional `reputation` / `reliability` fields\nare polymorphic per source (see [`Indicator`](#Indicator)) so the SDK does\nnot type them ahead of time; callers build the JSON shape themselves and\npass it through. Pass an existing `rule_id` on an item to upsert that IOC\ninstead of inserting a new one.\n","args":[],"type":"{ items : Json.Encode.Value }"},{"name":"InsertResult","comment":" Outcome of an [`insert`](#insert) call. `addedObjects` lists the newly\ncreated IOC IDs and the server's status string for each; `updatedObjects`\nlists upserts; `errors` collects per-item failures the server flagged\nwithout aborting the batch.\n","args":[],"type":"{ addedObjects : List.List Cortex.Api.Indicators.IndicatorChange, updatedObjects : List.List Cortex.Api.Indicators.IndicatorChange, errors : List.List Cortex.Api.Indicators.IndicatorError }"},{"name":"SearchArgs","comment":" Arguments to [`get`](#get). All fields are optional; pass\n[`defaultSearchArgs`](#defaultSearchArgs) for an unfiltered request. `extra`\nis merged last into `request_data` and overrides any SDK-generated key on\ncollision — e.g. the indicator endpoint's `extended_view` flag is reachable\nthrough it.\n","args":[],"type":"{ filters : List.List Cortex.Query.Filter, sort : Maybe.Maybe Cortex.Query.Sort, range : Maybe.Maybe Cortex.Query.Range, timeframe : Maybe.Maybe Cortex.Query.Timeframe, extra : List.List ( String.String, Json.Encode.Value ) }"}],"values":[{"name":"defaultSearchArgs","comment":" A [`SearchArgs`](#SearchArgs) with no filters, sort, pagination, or\ntimeframe.\n","type":"Cortex.Api.Indicators.SearchArgs"},{"name":"delete","comment":" POST /public\\_api/v1/indicators/delete — remove every IOC matching the\nfilters.\n","type":"Cortex.Api.Indicators.DeleteArgs -> Cortex.Request.Request Cortex.Api.Indicators.DeleteResult"},{"name":"deleteFilter","comment":" Build a [`DeleteFilter`](#DeleteFilter) from the raw triple. The\n`operator` should already be one of the API's uppercase keywords (`EQ`,\n`NEQ`, `IN`, `GTE`, `LTE`); the encoder writes it through verbatim.\n","type":"{ field : String.String, operator : String.String, value : Json.Encode.Value } -> Cortex.Api.Indicators.DeleteFilter"},{"name":"get","comment":" POST /public\\_api/v1/indicators/get\n\nResponse is top-level `{objects_count, objects, objects_type}` — NOT wrapped\nin the usual `reply` envelope.\n\n","type":"Cortex.Api.Indicators.SearchArgs -> Cortex.Request.Request Cortex.Api.Indicators.IndicatorsResponse"},{"name":"insert","comment":" POST /public\\_api/v1/indicators/insert — insert or upsert a batch of\nIOCs. The response carries the rule IDs of every IOC the server touched,\nwhich a test can use to delete what it inserted.\n","type":"Cortex.Api.Indicators.InsertArgs -> Cortex.Request.Request Cortex.Api.Indicators.InsertResult"}],"binops":[]},{"name":"Cortex.Api.Issues","comment":" Cortex issue records (alerts/incidents) and their tenant-defined schema.\n\nThe `/public_api/v1/issue/search` endpoint returns a paginated list of\n[`Issue`](#Issue) records — each with ~50 normalized fields covering issue\nidentity, detection metadata, asset references, MITRE ATT&CK mapping,\nstatus/resolution lifecycle, and assignment. The `/public_api/v1/issue/schema`\nendpoint returns the field schema (`field_name`, `field_pretty_name`,\n`data_type`) for every issue field — including custom fields the tenant has\ndefined.\n\n@docs SearchArgs, defaultSearchArgs\n@docs Issue, SearchResponse, IssueSchemaField\n@docs search, schema\n\n","unions":[],"aliases":[{"name":"Issue","comment":" A single issue record. All fields are `Maybe` because population varies\nby detection method, tenant, and feature flags. Field names use the live\nwire format (dotted namespacing for `detection.*` / `status.*`), with\n`oneOf` fallback to spec-form underscore names for forward compat.\n\n`normalizedFields` (~70 XDM-prefixed forensic fields) and `customFields`\n(tenant-defined arbitrary keys) are preserved verbatim — the former is\nfully populated only for advanced detection methods and is best surfaced\nas raw JSON until typed sub-records are added; the latter is unconstrained\nper tenant configuration and cannot be typed at the SDK layer.\n\n","args":[],"type":"{ id : Maybe.Maybe Basics.Int, externalId : Maybe.Maybe String.String, name : Maybe.Maybe String.String, description : Maybe.Maybe String.String, extendedDescription : Maybe.Maybe String.String, initialEvidence : Maybe.Maybe String.String, owner : Maybe.Maybe String.String, domain : Maybe.Maybe String.String, category : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String, severity : Maybe.Maybe String.String, detectionMethod : Maybe.Maybe String.String, detectionRuleId : Maybe.Maybe String.String, insertTime : Maybe.Maybe Basics.Int, observationTime : Maybe.Maybe Basics.Int, lastModified : Maybe.Maybe Basics.Int, resolutionTime : Maybe.Maybe Basics.Int, resolutionStatusModifiedTs : Maybe.Maybe Basics.Int, statusProgress : Maybe.Maybe String.String, statusResolutionReason : Maybe.Maybe String.String, statusResolutionComment : Maybe.Maybe String.String, assignedTo : Maybe.Maybe String.String, assignedToPretty : Maybe.Maybe String.String, isStarred : Maybe.Maybe Basics.Bool, isExcluded : Maybe.Maybe Basics.Bool, isExcepted : Maybe.Maybe Basics.Bool, exceptionIds : List.List String.String, exceptionExpiration : Maybe.Maybe Basics.Int, tags : List.List String.String, findings : List.List String.String, assetIds : List.List String.String, assetNames : List.List String.String, assetGroupIds : List.List Basics.Int, assetClasses : List.List String.String, assetCategories : List.List String.String, assetRegions : List.List String.String, assetProviders : List.List String.String, assetAccounts : List.List String.String, assetTypes : List.List String.String, assetExternalProviderIds : List.List String.String, assetCloudAccountNames : List.List String.String, mitreTactics : List.List String.String, mitreTechniques : List.List String.String, caseIds : List.List Basics.Int, remediation : Maybe.Maybe String.String, impact : Maybe.Maybe String.String, agenticResponseStatus : Maybe.Maybe String.String, agenticAssistantId : Maybe.Maybe String.String, agenticResponseConversationId : Maybe.Maybe String.String, actionStatus : Maybe.Maybe String.String, normalizedFields : Maybe.Maybe Json.Encode.Value, customFields : Maybe.Maybe Json.Encode.Value }"},{"name":"IssueSchemaField","comment":" One row of the issue field-schema response from [`schema`](#schema).\n","args":[],"type":"{ fieldName : Maybe.Maybe String.String, fieldPrettyName : Maybe.Maybe String.String, dataType : Maybe.Maybe String.String }"},{"name":"SearchArgs","comment":" Arguments to [`search`](#search). All fields are optional; pass\n[`defaultSearchArgs`](#defaultSearchArgs) for an unfiltered request. `extra`\nis merged last into `request_data` and overrides any SDK-generated key on\ncollision — use it for request fields the SDK has not modeled yet.\n","args":[],"type":"{ filters : List.List Cortex.Query.Filter, sort : Maybe.Maybe Cortex.Query.Sort, range : Maybe.Maybe Cortex.Query.Range, timeframe : Maybe.Maybe Cortex.Query.Timeframe, extra : List.List ( String.String, Json.Encode.Value ) }"},{"name":"SearchResponse","comment":" Paginated response from [`search`](#search). The live API returns\n`DATA`/`TOTAL_COUNT`/`FILTER_COUNT` (uppercase); the spec documents\n`issues`/`total_count`/`result_count` (lowercase). Both are accepted.\n","args":[],"type":"{ data : List.List Cortex.Api.Issues.Issue, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"}],"values":[{"name":"defaultSearchArgs","comment":" A [`SearchArgs`](#SearchArgs) with no filters, sort, pagination, or\ntimeframe.\n","type":"Cortex.Api.Issues.SearchArgs"},{"name":"schema","comment":" POST /public\\_api/v1/issue/schema\n\nRetrieve the issue field schema — every documented field, plus the\ntenant's custom fields. Some tenants surface this as HTTP 500 when not\nlicensed.\n\n","type":"Cortex.Request.Request (List.List Cortex.Api.Issues.IssueSchemaField)"},{"name":"search","comment":" POST /public\\_api/v1/issue/search\n\nRetrieve issues matching the given filters, sort, pagination, and\ntimeframe. Returns a [`SearchResponse`](#SearchResponse) with the typed\n[`Issue`](#Issue) records and pagination counts.\n\n","type":"Cortex.Api.Issues.SearchArgs -> Cortex.Request.Request Cortex.Api.Issues.SearchResponse"}],"binops":[]},{"name":"Cortex.Api.LegacyExceptions","comment":" Legacy policy exception modules and the per-rule list of currently\nconfigured exceptions.\n\nTwo endpoints:\n\n  - [`getModules`](#getModules) — list every module type that _can_ be\n    excepted (e.g. \"Malware > Behavioral Threat Protection\"), along with\n    a JSON-Schema-style `conditions_definition` describing what condition\n    shape that module accepts.\n\n  - [`list`](#list) — list the exception rules currently configured on\n    the tenant.\n\n@docs Module, Response, ExceptionRule\n@docs getModules, list\n\n","unions":[],"aliases":[{"name":"ExceptionRule","comment":" A single configured exception rule. `id` is a string (per spec — not\nthe integer identifier other Cortex endpoints use).\n","args":[],"type":"{ id : Maybe.Maybe String.String, ruleName : Maybe.Maybe String.String, platform : Maybe.Maybe String.String, conditions : Maybe.Maybe String.String, module_ : Maybe.Maybe Basics.Int, moduleName : Maybe.Maybe String.String, description : Maybe.Maybe String.String, generatingAlertId : Maybe.Maybe Json.Encode.Value, createdBy : Maybe.Maybe String.String, modificationTime : Maybe.Maybe Basics.Int, userEmail : Maybe.Maybe String.String, status : Maybe.Maybe String.String, profileIds : List.List Basics.Int, associatedTargets : List.List String.String, isInUserScope : Maybe.Maybe Basics.Bool }"},{"name":"Module","comment":" One legacy-exception module type — a category of policy that can have\nexceptions defined against it. `conditionsDefinition` is intentionally\nopaque (see field comment).\n","args":[],"type":"{ moduleId : Maybe.Maybe Basics.Int, prettyName : Maybe.Maybe String.String, title : Maybe.Maybe String.String, label : Maybe.Maybe String.String, profileType : Maybe.Maybe String.String, platforms : List.List String.String, conditionsDefinition : Json.Encode.Value }"},{"name":"Response","comment":" Paginated envelope returned by [`list`](#list).\n","args":[],"type":"{ data : List.List Cortex.Api.LegacyExceptions.ExceptionRule, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"}],"values":[{"name":"getModules","comment":" POST /public\\_api/v1/legacy\\_exceptions/get\\_modules\n\nList every legacy-exception module type that can have rules defined\nagainst it.\n\n","type":"Cortex.Request.Request (List.List Cortex.Api.LegacyExceptions.Module)"},{"name":"list","comment":" POST /public\\_api/v1/legacy\\_exceptions/fetch\n\nRetrieve the legacy exception rules currently configured on the tenant,\nwith optional filtering, sorting, and pagination.\n\n","type":"Cortex.Request.Request Cortex.Api.LegacyExceptions.Response"}],"binops":[]},{"name":"Cortex.Api.Profiles","comment":" Cortex endpoint security profiles and per-endpoint policy lookups.\n\n@docs Profile, GetPolicyResponse\n@docs getProfiles, getPolicy\n\n","unions":[],"aliases":[{"name":"GetPolicyResponse","comment":" Response from [`getPolicy`](#getPolicy).\n","args":[],"type":"{ policyName : Maybe.Maybe String.String }"},{"name":"Profile","comment":" A single endpoint security profile (prevention or extension).\n","args":[],"type":"{ id : Maybe.Maybe Basics.Int, uuid : Maybe.Maybe String.String, name : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String, platform : Maybe.Maybe String.String, description : Maybe.Maybe String.String, isDefault : Maybe.Maybe Basics.Bool, isGlobal : Maybe.Maybe Basics.Bool, isDisabled : Maybe.Maybe Basics.Bool, usageCount : Maybe.Maybe Basics.Int, associatedTargets : List.List String.String, createdBy : Maybe.Maybe String.String, createdByPretty : Maybe.Maybe String.String, creationTime : Maybe.Maybe Basics.Int, modifiedBy : Maybe.Maybe String.String, modifiedByPretty : Maybe.Maybe String.String, modificationTime : Maybe.Maybe Basics.Int, modules : Maybe.Maybe Json.Encode.Value }"}],"values":[{"name":"getPolicy","comment":" POST /public\\_api/v1/endpoints/get\\_policy\n\nGet the policy name assigned to a single endpoint. Requires the endpoint\nID; pass it via the record argument.\n\n","type":"{ endpointId : String.String } -> Cortex.Request.Request Cortex.Api.Profiles.GetPolicyResponse"},{"name":"getProfiles","comment":" POST /public\\_api/v1/endpoints/get\\_profiles\n\nGet endpoint security profiles of the requested type. The API requires\na `type` discriminator (`\"prevention\"` or `\"extension\"`); pass it via\nthe record argument.\n\n","type":"{ type_ : String.String } -> Cortex.Request.Request (List.List Cortex.Api.Profiles.Profile)"}],"binops":[]},{"name":"Cortex.Api.Quarantine","comment":" Quarantine status lookup for files on Cortex-managed endpoints.\n\n@docs FileQuery, FileStatus\n@docs getStatus\n\n","unions":[],"aliases":[{"name":"FileQuery","comment":" One file to look up, identified by the endpoint it lives on, its path, and\nits SHA-256 hash.\n\nThe OpenAPI spec swaps the `file_path` and `file_hash` field descriptions, but\nthe wire format and example payload confirm `filePath` is the on-disk path and\n`fileHash` is the SHA-256.\n\n","args":[],"type":"{ endpointId : String.String, filePath : String.String, fileHash : String.String }"},{"name":"FileStatus","comment":" Quarantine status of a single file, returned by [`getStatus`](#getStatus).\n\n`status` is `Just True` when the file is quarantined on the endpoint, `Just\nFalse` when it is not. All fields are wrapped in `Maybe` because the API\nschema does not mark them required.\n\n","args":[],"type":"{ endpointId : Maybe.Maybe String.String, filePath : Maybe.Maybe String.String, fileHash : Maybe.Maybe String.String, status : Maybe.Maybe Basics.Bool }"}],"values":[{"name":"getStatus","comment":" POST /public\\_api/v1/quarantine/status\n\nLook up the quarantine status of one or more files. The API rejects an empty\nlist with HTTP 500, so callers should pass at least one [`FileQuery`](#FileQuery).\n\n","type":"List.List Cortex.Api.Quarantine.FileQuery -> Cortex.Request.Request (List.List Cortex.Api.Quarantine.FileStatus)"}],"binops":[]},{"name":"Cortex.Api.Rbac","comment":" Cortex role-based access control: users, roles, and user groups.\n\n@docs User, Role, UserGroup\n@docs getUsers, getRoles, getUserGroups\n\n","unions":[],"aliases":[{"name":"Role","comment":" A Cortex RBAC role definition: permission list plus membership.\n","args":[],"type":"{ prettyName : Maybe.Maybe String.String, description : Maybe.Maybe String.String, permissions : List.List String.String, insertTime : Maybe.Maybe Basics.Int, updateTime : Maybe.Maybe Basics.Int, createdBy : Maybe.Maybe String.String, groups : List.List String.String, users : List.List String.String, tags : Maybe.Maybe Json.Encode.Value }"},{"name":"User","comment":" A Cortex RBAC user record.\n","args":[],"type":"{ userEmail : String.String, userFirstName : Maybe.Maybe String.String, userLastName : Maybe.Maybe String.String, roleName : Maybe.Maybe String.String, lastLoggedIn : Maybe.Maybe Basics.Int, userType : Maybe.Maybe String.String, groups : List.List String.String, scope : Maybe.Maybe Json.Encode.Value }"},{"name":"UserGroup","comment":" A Cortex user-group definition, including member emails.\n","args":[],"type":"{ groupName : Maybe.Maybe String.String, prettyName : Maybe.Maybe String.String, description : Maybe.Maybe String.String, source : Maybe.Maybe String.String, insertTime : Maybe.Maybe Basics.Int, updateTime : Maybe.Maybe Basics.Int, userEmail : List.List String.String }"}],"values":[{"name":"getRoles","comment":" POST /public\\_api/v1/rbac/get\\_roles\n\nThe API requires `role_names` to contain at least one role name; pass\nthem via the record argument. The response is a list-of-lists envelope\nwhich is flattened into a single `List Role`.\n\n","type":"{ roleNames : List.List String.String } -> Cortex.Request.Request (List.List Cortex.Api.Rbac.Role)"},{"name":"getUserGroups","comment":" POST /public\\_api/v1/rbac/get\\_user\\_group\n\nThe API requires `group_names` to contain at least one group name; pass\nthem via the record argument.\n\n","type":"{ groupNames : List.List String.String } -> Cortex.Request.Request (List.List Cortex.Api.Rbac.UserGroup)"},{"name":"getUsers","comment":" POST /public\\_api/v1/rbac/get\\_users\n","type":"Cortex.Request.Request (List.List Cortex.Api.Rbac.User)"}],"binops":[]},{"name":"Cortex.Api.Risk","comment":" Cortex identity-threat risk scoring for users and endpoints.\n\n@docs RiskLevel, RiskScoreResponse, RiskyEntity, Reason\n@docs getRiskScore, listRiskyHosts, listRiskyUsers\n\n","unions":[{"name":"RiskLevel","comment":" Cortex risk-level bucket — closed enum per the spec.\n\n  - `Low` — wire value `\"LOW\"`\n  - `Med` — wire value `\"MED\"` (note: not `\"MEDIUM\"`)\n  - `High` — wire value `\"HIGH\"`\n\n","args":[],"cases":[["Low",[]],["Med",[]],["High",[]]]}],"aliases":[{"name":"Reason","comment":" One reason contributing to a risk score. Note `dateCreated` decodes\nfrom the spec's `\"date created\"` (with a space).\n","args":[],"type":"{ dateCreated : Maybe.Maybe String.String, description : Maybe.Maybe String.String, severity : Maybe.Maybe String.String, status : Maybe.Maybe String.String, points : Maybe.Maybe Basics.Int }"},{"name":"RiskScoreResponse","comment":" Risk-score record for a single user or endpoint, returned by\n[`getRiskScore`](#getRiskScore).\n","args":[],"type":"{ type_ : Maybe.Maybe String.String, id : Maybe.Maybe String.String, score : Maybe.Maybe Basics.Int, normRiskScore : Maybe.Maybe Basics.Int, riskLevel : Maybe.Maybe Cortex.Api.Risk.RiskLevel, reasons : List.List Cortex.Api.Risk.Reason, email : Maybe.Maybe String.String }"},{"name":"RiskyEntity","comment":" One risky-user / risky-host entry returned by\n[`listRiskyUsers`](#listRiskyUsers) / [`listRiskyHosts`](#listRiskyHosts).\nShape matches [`RiskScoreResponse`](#RiskScoreResponse) — `email` is\npopulated for user entries only.\n","args":[],"type":"{ type_ : Maybe.Maybe String.String, id : Maybe.Maybe String.String, score : Maybe.Maybe Basics.Int, normRiskScore : Maybe.Maybe Basics.Int, riskLevel : Maybe.Maybe Cortex.Api.Risk.RiskLevel, reasons : List.List Cortex.Api.Risk.Reason, email : Maybe.Maybe String.String }"}],"values":[{"name":"getRiskScore","comment":" POST /public\\_api/v1/get\\_risk\\_score\n\nGet the risk score for a single user or endpoint. The API requires `id`\n(user samAccount in `netBIOS/samAccount` form, or a Cortex agent ID); pass\nit via the record argument.\n\n","type":"{ id : String.String } -> Cortex.Request.Request Cortex.Api.Risk.RiskScoreResponse"},{"name":"listRiskyHosts","comment":" POST /public\\_api/v1/get\\_risky\\_hosts\n\nReturns the highest-risk endpoints on the tenant.\n\n","type":"Cortex.Request.Request (List.List Cortex.Api.Risk.RiskyEntity)"},{"name":"listRiskyUsers","comment":" POST /public\\_api/v1/get\\_risky\\_users\n\nReturns the highest-risk users on the tenant.\n\n","type":"Cortex.Request.Request (List.List Cortex.Api.Risk.RiskyEntity)"}],"binops":[]},{"name":"Cortex.Api.ScheduledQueries","comment":" Cortex scheduled XQL queries configured on the tenant.\n\n@docs SearchArgs, defaultSearchArgs\n@docs ScheduledQuery, Schedule, ScheduledQueriesResponse\n@docs list\n@docs InsertArgs, QueryDefinition, ScheduleSpec, CronSpec, InsertedQuery, InsertResult\n@docs insert\n@docs DeleteArgs, DeleteOutcome, DeleteResult\n@docs delete\n\n","unions":[{"name":"DeleteOutcome","comment":" Per-id outcome inside [`DeleteResult`](#DeleteResult). `Deleted` is the\nserver's `true` reply; `DeleteFailed` carries the human-readable rejection\nreason.\n","args":[],"cases":[["Deleted",[]],["DeleteFailed",["String.String"]]]},{"name":"ScheduleSpec","comment":" Trigger schedule for an inserted query. `OneShot` runs the query a\nsingle time at `runAtMs` (epoch-milliseconds, must be in the future);\n`Cron` runs on a recurring crontab-style schedule.\n","args":[],"cases":[["OneShot",["{ runAtMs : Basics.Int }"]],["Cron",["Cortex.Api.ScheduledQueries.CronSpec"]]]}],"aliases":[{"name":"CronSpec","comment":" Cron-style trigger fields. Each `Maybe String` carries either a single\nvalue (e.g. `\"5\"`) or a comma-separated list / `*` wildcard accepted by\nthe Cortex scheduler. `startDate` / `endDate` bound the active window in\nepoch-milliseconds; the other fields are minute/hour/etc.\n","args":[],"type":"{ startDate : Maybe.Maybe Basics.Int, endDate : Maybe.Maybe Basics.Int, hour : Maybe.Maybe String.String, minute : Maybe.Maybe String.String, second : Maybe.Maybe String.String, dayOfWeek : Maybe.Maybe String.String, week : Maybe.Maybe String.String, month : Maybe.Maybe String.String }"},{"name":"DeleteArgs","comment":" Arguments to [`delete`](#delete). `ids` may be the assigned `query_id`\nstrings or the human-readable `query_definition_name` values; the API\naccepts either.\n","args":[],"type":"{ ids : List.List String.String }"},{"name":"DeleteResult","comment":" Outcome of a [`delete`](#delete) call: a `Dict` keyed by the same\n`ids` the caller submitted → success/failure.\n","args":[],"type":"Dict.Dict String.String Cortex.Api.ScheduledQueries.DeleteOutcome"},{"name":"InsertArgs","comment":" Arguments to [`insert`](#insert). `queries` is the batch of definitions\nto send.\n","args":[],"type":"{ queries : List.List Cortex.Api.ScheduledQueries.QueryDefinition }"},{"name":"InsertResult","comment":" Outcome of an [`insert`](#insert) call: a `Dict` keyed by the assigned\n`query_id` (e.g. `\"qc_1683461522_18780\"`) → the echoed definition. Empty\nfor a request that was rejected before any item was processed.\n","args":[],"type":"Dict.Dict String.String Cortex.Api.ScheduledQueries.InsertedQuery"},{"name":"InsertedQuery","comment":" The server-echoed definition returned in the [`InsertResult`](#InsertResult)\ndict, keyed by the assigned `query_id`. `timeframe` stays opaque for the\nsame reasons as [`ScheduledQuery`](#ScheduledQuery)`.timeframe`.\n","args":[],"type":"{ name : Maybe.Maybe String.String, xql : Maybe.Maybe String.String, timeframe : Maybe.Maybe Json.Encode.Value, schedule : Maybe.Maybe Cortex.Api.ScheduledQueries.Schedule }"},{"name":"QueryDefinition","comment":" One query definition to insert. `relativeTimeMs` is the rolling-window\nsize that the query inspects on every run, in epoch-milliseconds (e.g.\n`86400000` for the last 24 hours).\n","args":[],"type":"{ name : String.String, xql : String.String, relativeTimeMs : Basics.Int, schedule : Cortex.Api.ScheduledQueries.ScheduleSpec }"},{"name":"Schedule","comment":" Trigger schedule for a [`ScheduledQuery`](#ScheduledQuery). All\nfields optional — only the subset relevant to the trigger type is\npopulated. `triggerType = \"date\"` populates `runDate`; `\"cron\"` populates\n`startDate` / `endDate` / `hour` / `minute` / `second` / `dayOfWeek` /\n`week` / `month`.\n","args":[],"type":"{ triggerType : Maybe.Maybe String.String, runDate : Maybe.Maybe Basics.Int, startDate : Maybe.Maybe Basics.Int, endDate : Maybe.Maybe Basics.Int, hour : Maybe.Maybe String.String, minute : Maybe.Maybe String.String, second : Maybe.Maybe String.String, dayOfWeek : Maybe.Maybe String.String, week : Maybe.Maybe String.String, month : Maybe.Maybe String.String }"},{"name":"ScheduledQueriesResponse","comment":" Paginated envelope returned by [`list`](#list).\n","args":[],"type":"{ data : List.List Cortex.Api.ScheduledQueries.ScheduledQuery, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"},{"name":"ScheduledQuery","comment":" One scheduled XQL query configured on the tenant.\n","args":[],"type":"{ queryDefId : Maybe.Maybe String.String, queryDefinitionName : Maybe.Maybe String.String, xql : Maybe.Maybe String.String, enable : Maybe.Maybe Basics.Bool, schedule : Maybe.Maybe Cortex.Api.ScheduledQueries.Schedule, timeframe : Maybe.Maybe Json.Encode.Value, tenants : Maybe.Maybe Json.Encode.Value }"},{"name":"SearchArgs","comment":" Arguments to [`list`](#list). All fields are optional; pass\n[`defaultSearchArgs`](#defaultSearchArgs) for an unfiltered request. `extra`\nis merged last into `request_data` and overrides any SDK-generated key on\ncollision — the endpoint's `extended_view` and `list_ids` fields are\nreachable through it.\n","args":[],"type":"{ filters : List.List Cortex.Query.Filter, sort : Maybe.Maybe Cortex.Query.Sort, range : Maybe.Maybe Cortex.Query.Range, timeframe : Maybe.Maybe Cortex.Query.Timeframe, extra : List.List ( String.String, Json.Encode.Value ) }"}],"values":[{"name":"defaultSearchArgs","comment":" A [`SearchArgs`](#SearchArgs) with no filters, sort, pagination, or\ntimeframe.\n","type":"Cortex.Api.ScheduledQueries.SearchArgs"},{"name":"delete","comment":" POST /public\\_api/v1/scheduled\\_queries/delete — remove scheduled\nqueries by id or by name.\n","type":"Cortex.Api.ScheduledQueries.DeleteArgs -> Cortex.Request.Request Cortex.Api.ScheduledQueries.DeleteResult"},{"name":"insert","comment":" POST /public\\_api/v1/scheduled\\_queries/insert — insert a batch of\nscheduled XQL queries. The server assigns each query a fresh ID; consult\nthe keys of the returned [`InsertResult`](#InsertResult) to delete or\nmanage them later.\n","type":"Cortex.Api.ScheduledQueries.InsertArgs -> Cortex.Request.Request Cortex.Api.ScheduledQueries.InsertResult"},{"name":"list","comment":" POST /public\\_api/v1/scheduled\\_queries/list\n\nRetrieve scheduled XQL queries currently configured on the tenant, with\noptional filters and pagination. Requires Instance Administrator\npermissions.\n\n","type":"Cortex.Api.ScheduledQueries.SearchArgs -> Cortex.Request.Request Cortex.Api.ScheduledQueries.ScheduledQueriesResponse"}],"binops":[]},{"name":"Cortex.Api.TenantInfo","comment":" Cortex tenant license, SKU, and add-on metadata.\n\nThe response from `/public_api/v1/system/get_tenant_info` is a wide record\nof license expiration timestamps, installed/purchased counts, and nested\n\"purchased\" sub-records describing each add-on. Every field is optional —\nwhich fields are populated depends on the tenant's product mix.\n\nTwo notable wire-format quirks this module handles:\n\n  - **Polymorphic expirations.** `*_expiration` fields are sometimes\n    returned as the integer `0` (the add-on is not purchased), sometimes\n    as a positive integer (a unix-epoch timestamp), and sometimes as a\n    pre-formatted date string (e.g. `\"Mar 19th 2027 23:59:59\"`). Decoded\n    into the [`Expiration`](#Expiration) union.\n\n  - **Polymorphic `purchased_*` shapes.** Most `purchased_*` fields can\n    be either the integer `0` (not purchased) or a small nested record\n    listing the purchased capacity (`{ \"users\": 100, \"gb\": 100, ... }`).\n    Decoded as `Maybe SomePurchasedShape` where `Nothing` covers both\n    \"field absent\" and \"integer 0\".\n\n@docs TenantInfo, Expiration\n@docs PurchasedXsiamPremium, PurchasedAgents, PurchasedGb, PurchasedUsers, PurchasedWorkloads\n@docs get\n\n","unions":[{"name":"Expiration","comment":" A license expiration as the API actually emits it.\n\n  - `Disabled` — wire integer `0` (the add-on is not purchased).\n  - `Timestamp` — wire positive integer (unix-epoch millis or seconds).\n  - `DateString` — wire pre-formatted string (e.g. `\"Mar 19th 2027 23:59:59\"`).\n\n","args":[],"cases":[["Disabled",[]],["Timestamp",["Basics.Int"]],["DateString",["String.String"]]]}],"aliases":[{"name":"PurchasedAgents","comment":" `purchased_pro_cloud` / `purchased_pro_per_endpoint` capacity.\n","args":[],"type":"{ agents : Maybe.Maybe Basics.Int }"},{"name":"PurchasedGb","comment":" `purchased_pro_gb` / `purchased_data_lake_gb` capacity.\n","args":[],"type":"{ gb : Maybe.Maybe Basics.Int }"},{"name":"PurchasedUsers","comment":" `purchased_agentix_soar` / `purchased_agentix_tim` capacity.\n","args":[],"type":"{ users : Maybe.Maybe Basics.Int }"},{"name":"PurchasedWorkloads","comment":" `purchased_cloud_posture` capacity.\n","args":[],"type":"{ workloads : Maybe.Maybe Basics.Int }"},{"name":"PurchasedXsiamPremium","comment":" `purchased_xsiam_premium` capacity breakdown.\n","args":[],"type":"{ users : Maybe.Maybe Basics.Int, gb : Maybe.Maybe Basics.Int, agents : Maybe.Maybe Basics.Int }"},{"name":"TenantInfo","comment":" Full tenant licensing/configuration record. Every field is `Maybe` —\nthe API only emits fields relevant to the tenant's purchased products,\nand field coverage varies between tenants and SKUs.\n","args":[],"type":"{ advancedAnalyticsExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, agentixSoarExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, agentixTimExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, attackSurfaceManagementExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, cloudPostureExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, computeUnitExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, dataLakeGbExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, forensicsExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, hostInsightsExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, identityThreatExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, preventExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, proCloudExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, proGbExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, proPerEndpointExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, threatIntelligenceManagementExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, xsiamEpColdExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, xsiamEpHotExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, xsiamGbColdExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, xsiamGbHotExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, xsiamPremiumExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, xthExpiration : Maybe.Maybe Cortex.Api.TenantInfo.Expiration, dataEnabledProCloud : Maybe.Maybe Basics.Int, dataEnabledProPerEndpoint : Maybe.Maybe Basics.Int, enabledForensics : Maybe.Maybe Basics.Int, enabledHostInsights : Maybe.Maybe Basics.Int, installedAgentixSoar : Maybe.Maybe Basics.Int, installedAgentixTim : Maybe.Maybe Basics.Int, installedCloudPosture : Maybe.Maybe Basics.Int, installedDataLakeGb : Maybe.Maybe Basics.Int, installedPrevent : Maybe.Maybe Basics.Int, installedProCloud : Maybe.Maybe Basics.Int, installedProGb : Maybe.Maybe Basics.Int, purchasedAttackSurfaceManagement : Maybe.Maybe Basics.Int, purchasedComputeUnit : Maybe.Maybe Basics.Int, purchasedHostInsights : Maybe.Maybe Basics.Int, purchasedPrevent : Maybe.Maybe Basics.Int, purchasedThreatIntelligenceManagement : Maybe.Maybe Basics.Int, purchasedXsiamEpCold : Maybe.Maybe Basics.Int, purchasedXsiamEpHot : Maybe.Maybe Basics.Int, purchasedXsiamGbCold : Maybe.Maybe Basics.Int, purchasedXsiamGbHot : Maybe.Maybe Basics.Int, purchasedXth : Maybe.Maybe Basics.Int, purchasedAgentixSoar : Maybe.Maybe Cortex.Api.TenantInfo.PurchasedUsers, purchasedAgentixTim : Maybe.Maybe Cortex.Api.TenantInfo.PurchasedUsers, purchasedCloudPosture : Maybe.Maybe Cortex.Api.TenantInfo.PurchasedWorkloads, purchasedDataLakeGb : Maybe.Maybe Cortex.Api.TenantInfo.PurchasedGb, purchasedProCloud : Maybe.Maybe Cortex.Api.TenantInfo.PurchasedAgents, purchasedProGb : Maybe.Maybe Cortex.Api.TenantInfo.PurchasedGb, purchasedProPerEndpoint : Maybe.Maybe Cortex.Api.TenantInfo.PurchasedAgents, purchasedXsiamPremium : Maybe.Maybe Cortex.Api.TenantInfo.PurchasedXsiamPremium }"}],"values":[{"name":"get","comment":" POST /public\\_api/v1/system/get\\_tenant\\_info\n\nRetrieve license, SKU, and add-on metadata for the tenant. Response is\nwrapped in the `reply` envelope; this function unwraps it and decodes\ninto [`TenantInfo`](#TenantInfo).\n\n","type":"Cortex.Request.Request Cortex.Api.TenantInfo.TenantInfo"}],"binops":[]},{"name":"Cortex.Api.TriagePresets","comment":" Forensics triage presets — named, OS-scoped collections of artifacts the\nendpoint agent collects when triggered. Read-only via the public API.\n\n@docs TriagePreset, TriagePresetsResponse\n@docs list\n\n","unions":[],"aliases":[{"name":"TriagePreset","comment":" A single triage preset description.\n","args":[],"type":"{ uuid : Maybe.Maybe String.String, name : Maybe.Maybe String.String, os : Maybe.Maybe String.String, description : Maybe.Maybe String.String, createdBy : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String }"},{"name":"TriagePresetsResponse","comment":" Envelope returned by [`list`](#list).\n","args":[],"type":"{ triagePresets : List.List Cortex.Api.TriagePresets.TriagePreset }"}],"values":[{"name":"list","comment":" POST /public\\_api/v1/get\\_triage\\_presets\n","type":"Cortex.Request.Request Cortex.Api.TriagePresets.TriagePresetsResponse"}],"binops":[]},{"name":"Cortex.Api.Xql","comment":" XQL: saved queries, available datasets, tenant quota counters, query\nexecution (async start/poll), and lookup-dataset row management.\n\n@docs Dataset, DatasetRange, Library, LibraryQuery, Quota\n@docs getDatasets, getLibrary, getQuota\n@docs QueryStatus, Timeframe\n@docs StartQueryArgs, GetResultsArgs, QueryResults, StreamArgs\n@docs startQuery, getQueryResults, getQueryResultsStream\n@docs LookupAddArgs, LookupAddResult\n@docs LookupGetArgs, LookupGetResult\n@docs LookupRemoveArgs, LookupRemoveResult\n@docs lookupsAddData, lookupsGetData, lookupsRemoveData\n@docs LibraryInsertArgs, LibraryInsertQuery, LibraryInsertResult, LibraryInsertError\n@docs libraryInsert\n@docs LibraryDeleteCriteria, LibraryDeleteArgs, LibraryDeleteResult\n@docs libraryDelete\n\n","unions":[{"name":"LibraryDeleteCriteria","comment":" Selector for [`libraryDelete`](#libraryDelete). The API rejects any\nrequest that combines names and tags, so the SDK forces callers to pick\none at compile time.\n","args":[],"cases":[["ByNames",["List.List String.String"]],["ByTags",["List.List String.String"]]]},{"name":"QueryStatus","comment":" Status of an async XQL query. `OtherStatus` is a forward-compatibility\nescape hatch — the documented values are `PENDING` / `SUCCESS` / `FAIL`.\n","args":[],"cases":[["Pending",[]],["Success",[]],["Fail",[]],["OtherStatus",["String.String"]]]},{"name":"Timeframe","comment":" Time window for a query. `Relative` is a duration in epoch-milliseconds\n(e.g. `Relative 86400000` = last 24 hours); `Range` is an absolute\n`from`/`to` epoch-millisecond window.\n","args":[],"cases":[["Relative",["Basics.Int"]],["Range",["{ from : Basics.Int, to : Basics.Int }"]]]}],"aliases":[{"name":"Dataset","comment":" A dataset available to XQL queries, with its retention ranges and size\nstats. The wire format uses Title Case Spaced keys (\"Dataset Name\", \"Last\nUpdated\", \"Total Events\", etc.) — not snake\\_case. `defaultQueryTarget` is\nemitted as a string (\"TRUE\" / \"FALSE\"), not a boolean.\n","args":[],"type":"{ datasetName : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String, logUpdateType : Maybe.Maybe String.String, lastUpdated : Maybe.Maybe Basics.Int, totalDaysStored : Maybe.Maybe Basics.Int, hotRange : Maybe.Maybe Cortex.Api.Xql.DatasetRange, coldRange : Maybe.Maybe Cortex.Api.Xql.DatasetRange, totalSizeStored : Maybe.Maybe Basics.Int, averageDailySize : Maybe.Maybe Basics.Int, totalEvents : Maybe.Maybe Basics.Int, averageEventSize : Maybe.Maybe Basics.Int, ttl : Maybe.Maybe Basics.Int, defaultQueryTarget : Maybe.Maybe String.String }"},{"name":"DatasetRange","comment":" Epoch-millisecond `from`/`to` range inside [`Dataset`](#Dataset).\n","args":[],"type":"{ from : Maybe.Maybe Basics.Int, to : Maybe.Maybe Basics.Int }"},{"name":"GetResultsArgs","comment":" Arguments to [`getQueryResults`](#getQueryResults). `pendingFlag = Just\nFalse` makes the server block until the query completes (subject to the\nper-request HTTP timeout); the default `Nothing` / `Just True` returns\nwhatever status the server has right now.\n","args":[],"type":"{ queryId : String.String, pendingFlag : Maybe.Maybe Basics.Bool, limit : Maybe.Maybe Basics.Int, format : Maybe.Maybe String.String }"},{"name":"Library","comment":" Saved-query library returned by [`getLibrary`](#getLibrary).\n","args":[],"type":"{ queriesCount : Maybe.Maybe Basics.Int, xqlQueries : List.List Cortex.Api.Xql.LibraryQuery }"},{"name":"LibraryDeleteArgs","comment":" Arguments to [`libraryDelete`](#libraryDelete).\n","args":[],"type":"{ criteria : Cortex.Api.Xql.LibraryDeleteCriteria }"},{"name":"LibraryDeleteResult","comment":" Outcome of a [`libraryDelete`](#libraryDelete) call. `queriesCount` is\nthe number of saved queries the server removed; `xqlQueryNames` is the\nlist of names it removed; `errors` is the list of free-form per-item\nfailure objects the server flagged without aborting the batch.\n","args":[],"type":"{ queriesCount : Basics.Int, xqlQueryNames : List.List String.String, errors : List.List Json.Encode.Value }"},{"name":"LibraryInsertArgs","comment":" Arguments to [`libraryInsert`](#libraryInsert). `xqlQueries` is the\nbatch to insert or upsert. With `override = False` the server rejects any\nentry whose name already exists; with `override = True` it upserts. `tags`\nis an optional list of labels applied to every query in the batch.\n","args":[],"type":"{ xqlQueries : List.List Cortex.Api.Xql.LibraryInsertQuery, override : Basics.Bool, tags : List.List String.String }"},{"name":"LibraryInsertError","comment":" One row in the [`LibraryInsertResult`](#LibraryInsertResult) `errors`\narray — the offending query name and the server's human-readable\nrejection reason.\n","args":[],"type":"{ name : String.String, message : String.String }"},{"name":"LibraryInsertQuery","comment":" One row in [`LibraryInsertArgs`](#LibraryInsertArgs)`.xqlQueries`. The\nSDK serialises `name` to `xql_query_name` and `query` to `xql_query` on\nthe wire.\n","args":[],"type":"{ name : String.String, query : String.String }"},{"name":"LibraryInsertResult","comment":" Outcome of a [`libraryInsert`](#libraryInsert) call. `added` and\n`updated` are the names of queries the server created or upserted; `errors`\nis the list of per-item rejections (`{name, message}` pairs the API\nreturns as `[name, message]` two-element arrays).\n","args":[],"type":"{ added : List.List String.String, updated : List.List String.String, errors : List.List Cortex.Api.Xql.LibraryInsertError }"},{"name":"LibraryQuery","comment":" A single saved XQL query inside the [`Library`](#Library). The live wire\nformat uses `xql_query_name`, `xql_query`, and `xql_query_tags` for the\nquery name, body, and tags; OpenAPI-schema field names like `name`,\n`query_text`, and `labels` are accepted as fallbacks.\n","args":[],"type":"{ id : Maybe.Maybe Basics.Int, name : Maybe.Maybe String.String, description : Maybe.Maybe String.String, queryText : Maybe.Maybe String.String, createdAt : Maybe.Maybe Basics.Int, createdBy : Maybe.Maybe String.String, createdByPretty : Maybe.Maybe String.String, modifiedAt : Maybe.Maybe Basics.Int, modifiedBy : Maybe.Maybe String.String, modifiedByPretty : Maybe.Maybe String.String, queryMetadata : Maybe.Maybe Json.Encode.Value, isPrivate : Maybe.Maybe Basics.Bool, labels : List.List String.String }"},{"name":"LookupAddArgs","comment":" Arguments to [`lookupsAddData`](#lookupsAddData). Each row in `data`\nshould be an object mapping field names to string values (the lookup dataset\nschema enforces per-field types server-side). With `keyFields = []` the\nserver inserts only; with non-empty `keyFields` the server upserts using\nthose fields as the identity.\n\n`data` is `Encode.Value` because the lookup-dataset schema is user-defined\nper dataset; the SDK cannot constrain the shape ahead of time.\n\n","args":[],"type":"{ datasetName : String.String, keyFields : List.List String.String, data : Json.Encode.Value }"},{"name":"LookupAddResult","comment":" Counts returned by [`lookupsAddData`](#lookupsAddData).\n","args":[],"type":"{ added : Maybe.Maybe Basics.Int, updated : Maybe.Maybe Basics.Int, skipped : Maybe.Maybe Basics.Int }"},{"name":"LookupGetArgs","comment":" Arguments to [`lookupsGetData`](#lookupsGetData). Each entry in `filters`\nis a full object of AND-ed `(field, value)` pairs; multiple entries OR\ntogether.\n","args":[],"type":"{ datasetName : String.String, filters : List.List (List.List ( String.String, String.String )), limit : Maybe.Maybe Basics.Int }"},{"name":"LookupGetResult","comment":" Payload returned by [`lookupsGetData`](#lookupsGetData).\n","args":[],"type":"{ data : Maybe.Maybe Json.Encode.Value, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"},{"name":"LookupRemoveArgs","comment":" Arguments to [`lookupsRemoveData`](#lookupsRemoveData). `filters` is a\nsingle AND-ed filter object (not the list-of-objects shape that\n[`lookupsGetData`](#lookupsGetData) uses).\n","args":[],"type":"{ datasetName : String.String, filters : List.List ( String.String, String.String ) }"},{"name":"LookupRemoveResult","comment":" Row-count returned by [`lookupsRemoveData`](#lookupsRemoveData).\n","args":[],"type":"{ deleted : Maybe.Maybe Basics.Int }"},{"name":"QueryResults","comment":" Typed decoding of a `get_query_results` response. `data` and `streamId`\nare flattened up out of the nested `results` sub-object for ergonomic access.\n\nThe wire format exposes the per-tenant cost map under `query_cost_charged`\n(not `query_cost` as the current OpenAPI revision documents) and includes a\n`remaining_yearly_quota` counter alongside the daily `remaining_quota` — both\nare captured here so the typed decoder doesn't silently drop real response\nfields.\n\n","args":[],"type":"{ status : Cortex.Api.Xql.QueryStatus, numberOfResults : Maybe.Maybe Basics.Int, queryCostCharged : Maybe.Maybe Json.Encode.Value, remainingQuota : Maybe.Maybe Basics.Float, remainingYearlyQuota : Maybe.Maybe Basics.Float, data : List.List Json.Encode.Value, streamId : Maybe.Maybe String.String }"},{"name":"Quota","comment":" The Cortex tenant returns quota counters as JSON numbers that may carry a\ndecimal component (e.g. `4015.0`), even though the OpenAPI schema documents\nthem as integers. We decode every quota field as Float so the values survive\nroundtripping through the typed decoder without integer coercion dropping the\nfractional part.\n\n`dailyUsedQuota` is not listed in the OpenAPI schema but is returned by the\nAPI in practice — per CLAUDE.md we capture every field the response contains.\n\n","args":[],"type":"{ licenseQuota : Maybe.Maybe Basics.Float, additionalPurchasedQuota : Maybe.Maybe Basics.Float, usedQuota : Maybe.Maybe Basics.Float, dailyUsedQuota : Maybe.Maybe Basics.Float, evalQuota : Maybe.Maybe Basics.Float, totalDailyRunningQueries : Maybe.Maybe Basics.Int, totalDailyConcurrentRejectedQueries : Maybe.Maybe Basics.Int, currentConcurrentActiveQueries : Json.Encode.Value, currentConcurrentActiveQueriesCount : Maybe.Maybe Basics.Int, maxDailyConcurrentActiveQueryCount : Maybe.Maybe Basics.Int }"},{"name":"StartQueryArgs","comment":" Arguments to [`startQuery`](#startQuery). `tenants` is only meaningful in\nMSSP multi-tenant deployments — leave it `[]` for a single-tenant query.\n","args":[],"type":"{ query : String.String, timeframe : Maybe.Maybe Cortex.Api.Xql.Timeframe, tenants : List.List String.String }"},{"name":"StreamArgs","comment":" Arguments to [`getQueryResultsStream`](#getQueryResultsStream). The\n`stream_id` comes from a prior [`QueryResults`](#QueryResults) whose result\nset exceeded the single-response `limit`.\n","args":[],"type":"{ streamId : String.String, isGzipCompressed : Maybe.Maybe Basics.Bool }"}],"values":[{"name":"getDatasets","comment":" POST /public\\_api/v1/xql/get\\_datasets\n","type":"Cortex.Request.Request (List.List Cortex.Api.Xql.Dataset)"},{"name":"getLibrary","comment":" POST /public\\_api/xql\\_library/get\n","type":"Cortex.Request.Request Cortex.Api.Xql.Library"},{"name":"getQueryResults","comment":" POST /public\\_api/v1/xql/get\\_query\\_results — fetches the status and (when\nready) results for a previously-started query. If `status = Pending`, call\nagain after a short delay; if results exceeded the single-response `limit`,\ncontinue fetching via [`getQueryResultsStream`](#getQueryResultsStream)\nwith the returned `streamId`.\n","type":"Cortex.Api.Xql.GetResultsArgs -> Cortex.Request.Request Cortex.Api.Xql.QueryResults"},{"name":"getQueryResultsStream","comment":" POST /public\\_api/v1/xql/get\\_query\\_results\\_stream — pulls the tail of a\nlarge result set. The response shape is not in the OpenAPI schema (the\nCortex API sends it chunked, optionally gzipped) so we pass it through as\nraw JSON.\n","type":"Cortex.Api.Xql.StreamArgs -> Cortex.Request.Request Json.Encode.Value"},{"name":"getQuota","comment":" POST /public\\_api/v1/xql/get\\_quota\n","type":"Cortex.Request.Request Cortex.Api.Xql.Quota"},{"name":"libraryDelete","comment":" POST /public\\_api/xql\\_library/delete — remove saved XQL queries by\nname or by tag.\n","type":"Cortex.Api.Xql.LibraryDeleteArgs -> Cortex.Request.Request Cortex.Api.Xql.LibraryDeleteResult"},{"name":"libraryInsert","comment":" POST /public\\_api/xql\\_library/insert — insert or upsert a batch of\nsaved XQL queries.\n","type":"Cortex.Api.Xql.LibraryInsertArgs -> Cortex.Request.Request Cortex.Api.Xql.LibraryInsertResult"},{"name":"lookupsAddData","comment":" POST /public\\_api/v1/xql/lookups/add\\_data — insert or upsert rows into a\nlookup dataset.\n","type":"Cortex.Api.Xql.LookupAddArgs -> Cortex.Request.Request Cortex.Api.Xql.LookupAddResult"},{"name":"lookupsGetData","comment":" POST /public\\_api/v1/xql/lookups/get\\_data — query rows in a lookup\ndataset with optional AND/OR-ed filter objects.\n","type":"Cortex.Api.Xql.LookupGetArgs -> Cortex.Request.Request Cortex.Api.Xql.LookupGetResult"},{"name":"lookupsRemoveData","comment":" POST /public\\_api/v1/xql/lookups/remove\\_data — delete rows in a lookup\ndataset matching the given filter object.\n","type":"Cortex.Api.Xql.LookupRemoveArgs -> Cortex.Request.Request Cortex.Api.Xql.LookupRemoveResult"},{"name":"startQuery","comment":" POST /public\\_api/v1/xql/start\\_xql\\_query — kicks off an XQL query and\nreturns the `query_id` string to poll with [`getQueryResults`](#getQueryResults).\n","type":"Cortex.Api.Xql.StartQueryArgs -> Cortex.Request.Request String.String"}],"binops":[]},{"name":"Cortex.Auth","comment":" Advanced-API Auth signing for Cortex. Each authenticated request carries\na SHA-256 hash of `apiKey ++ nonce ++ timestamp` plus three sidecar headers.\n\n@docs Credentials, Stamp\n@docs credentials, stamp\n@docs sign, nonceGenerator\n\n","unions":[{"name":"Credentials","comment":" Opaque container for an Advanced API key pair. Construct via\n[`credentials`](#credentials); the raw `apiKey` is kept inaccessible to\nprevent accidental logging.\n","args":[],"cases":[]},{"name":"Stamp","comment":" Opaque container for the timestamp + nonce pair that signs a single\nrequest. The timestamp is milliseconds since epoch; the nonce is a random\nstring of at least 32 characters per the Cortex Advanced Auth spec.\n","args":[],"cases":[]}],"aliases":[],"values":[{"name":"credentials","comment":" Build a `Credentials` from the raw API Key ID and API Key strings\n(typically sourced from `CORTEX_API_KEY_ID` / `CORTEX_API_KEY`).\n","type":"{ apiKeyId : String.String, apiKey : String.String } -> Cortex.Auth.Credentials"},{"name":"nonceGenerator","comment":" Generate a 64-character random nonce from [A-Za-z0-9].\nSuitable for browser use where crypto.randomBytes is unavailable.\nThe CLI uses Node's crypto.randomBytes instead.\n","type":"Random.Generator String.String"},{"name":"sign","comment":" Produce the four Advanced API Auth headers.\n\n    hash =\n        SHA256.toHex (SHA256.fromString (apiKey ++ nonce ++ String.fromInt timestamp))\n\nHeaders sent:\n\n  - Authorization: the hex SHA-256 hash\n  - x-xdr-auth-id: the API key ID\n  - x-xdr-timestamp: millis since epoch (as string)\n  - x-xdr-nonce: the nonce string\n\n","type":"Cortex.Auth.Credentials -> Cortex.Auth.Stamp -> List.List Http.Header"},{"name":"stamp","comment":" Build a `Stamp` from a millis-since-epoch timestamp and a random nonce.\n","type":"{ timestamp : Basics.Int, nonce : String.String } -> Cortex.Auth.Stamp"}],"binops":[]},{"name":"Cortex.Client","comment":" Drives HTTP for the SDK. This is the only module with effects — every\n`Cortex.Api.*` module produces a pure [`Request`](Cortex-Request#Request) that\nis dispatched through `send` / `sendWith`.\n\n@docs Config, config, withTimeout\n@docs send, sendWith\n@docs toRequestRecord\n\n","unions":[{"name":"Config","comment":" Opaque HTTP client configuration. Holds the tenant base URL, the API\ncredentials, and the per-request timeout. Construct via [`config`](#config)\nand tweak with [`withTimeout`](#withTimeout).\n","args":[],"cases":[]}],"aliases":[],"values":[{"name":"config","comment":" Build a `Config` from the tenant base URL and credentials. The timeout\ndefaults to 30 seconds; change it with [`withTimeout`](#withTimeout).\n","type":"{ tenant : String.String, credentials : Cortex.Auth.Credentials } -> Cortex.Client.Config"},{"name":"send","comment":" Send a request using Time.now for the timestamp and elm/random for the nonce.\nSuitable for browser apps.\n","type":"Cortex.Client.Config -> (Result.Result Cortex.Error.Error a -> msg) -> Cortex.Request.Request a -> Platform.Cmd.Cmd msg"},{"name":"sendWith","comment":" Send a request with a caller-supplied stamp. The CLI uses this so the nonce\ncomes from Node's crypto.randomBytes rather than Elm's PRNG.\n","type":"Cortex.Auth.Stamp -> Cortex.Client.Config -> (Result.Result Cortex.Error.Error a -> msg) -> Cortex.Request.Request a -> Platform.Cmd.Cmd msg"},{"name":"toRequestRecord","comment":" Build a pure record from a Config, Stamp, and Request.\nUseful for consumers who want to drive Http themselves.\n","type":"Cortex.Client.Config -> Cortex.Auth.Stamp -> Cortex.Request.Request a -> { method : String.String, headers : List.List Http.Header, url : String.String, body : Http.Body, decoder : Json.Decode.Decoder a }"},{"name":"withTimeout","comment":" Set a new per-request timeout, in milliseconds.\n","type":"Basics.Float -> Cortex.Client.Config -> Cortex.Client.Config"}],"binops":[]},{"name":"Cortex.Decode","comment":" Decoder helpers shared across `Cortex.Api.*` modules.\n\nThe Cortex Advanced API consistently wraps responses in a `{\"reply\": ...}`\nenvelope, several response shapes return lists that may be omitted when\nempty, and pipeline-style decoders need an `andMap` once `Json.Decode.map8`\nruns out of slots. Centralising these primitives here keeps the per-API\nmodules focused on their own shapes.\n\n@docs reply, optionalField, optionalList, andMap\n\n","unions":[],"aliases":[],"values":[{"name":"andMap","comment":" Pipeline-style helper to apply an additional decoder when `Decode.mapN`\nruns out of positional slots.\n","type":"Json.Decode.Decoder a -> Json.Decode.Decoder (a -> b) -> Json.Decode.Decoder b"},{"name":"optionalField","comment":" Decode a field that may be absent, returning `Maybe`. Equivalent to\n`Decode.maybe (Decode.field name d)` but reads more naturally in\npipeline-style decoders.\n","type":"String.String -> Json.Decode.Decoder a -> Json.Decode.Decoder (Maybe.Maybe a)"},{"name":"optionalList","comment":" Decode a list field, defaulting to the empty list when the field is absent.\n","type":"String.String -> Json.Decode.Decoder a -> Json.Decode.Decoder (List.List a)"},{"name":"reply","comment":" Unwrap the `reply` envelope that Cortex wraps around every success response.\n","type":"Json.Decode.Decoder a -> Json.Decode.Decoder a"}],"binops":[]},{"name":"Cortex.Error","comment":" Errors produced by [`Cortex.Client.send`](Cortex-Client#send). Wraps the\nfour standard `elm/http` failure modes and adds a normalized decoding of the\nfour different error envelopes the Cortex API returns.\n\n@docs Error, ApiError\n@docs decodeApiError\n\n","unions":[{"name":"Error","comment":" What can go wrong when sending a request.\n\n  - `NetworkError` — the request never reached the server.\n  - `Timeout` — no response within the configured timeout.\n  - `BadStatus code maybeApiError` — the server responded with a 4xx/5xx.\n    The payload is parsed into an [`ApiError`](#ApiError) if it matches one\n    of the known envelope shapes; otherwise it's `Nothing`.\n  - `BadBody detail` — a 2xx response whose body did not match the decoder.\n  - `BadUrl url` — the URL was rejected by `elm/http` before dispatch.\n\n","args":[],"cases":[["NetworkError",[]],["Timeout",[]],["BadStatus",["Basics.Int","Maybe.Maybe Cortex.Error.ApiError"]],["BadBody",["String.String"]],["BadUrl",["String.String"]]]}],"aliases":[{"name":"ApiError","comment":" A server-reported error, normalized across the four envelope shapes the\nCortex API is known to return. `errCode` and `errExtra` are optional because\nnot every envelope includes them.\n","args":[],"type":"{ errCode : Maybe.Maybe String.String, errMsg : String.String, errExtra : Maybe.Maybe Json.Encode.Value }"}],"values":[{"name":"decodeApiError","comment":" Try multiple known error envelope shapes, in priority order.\nReturns the first successful parse as an ApiError.\n\nThe body is parsed to a `Decode.Value` once up-front; each candidate decoder\nis then attempted against that parsed value rather than re-parsing the\noriginal string. Matters on large error bodies.\n\n","type":"String.String -> Maybe.Maybe Cortex.Error.ApiError"}],"binops":[]},{"name":"Cortex.Query","comment":" Shared request-body building blocks used by Cortex list/search endpoints.\n\nMost Advanced API endpoints accept a common set of fields inside\n`request_data` — `filters`, `sort`, `search_from`/`search_to`, and a\n`timeframe`. This module defines the opaque value types for those fields and\nthe constructors / encoders that build them. Endpoint modules combine these\ninto a [`Cortex.RequestData.Standard`](Cortex-RequestData#Standard) envelope\nand hand it to [`Cortex.Request.post`](Cortex-Request#post).\n\nValues are opaque so the wire format (operator keywords, `keyword: asc|desc`,\nepoch-ms time windows) stays an implementation detail that can shift without\nbreaking callers.\n\nA small number of endpoints — most notably the asset-inventory `POST\n/public_api/v1/assets` and the cloud-API list endpoints — use a different\nwire shape (`{SEARCH_FIELD, SEARCH_TYPE, SEARCH_VALUE}` with uppercase\noperators, sort wrapped in an array, etc.). [`Dialect`](#Dialect) selects\nwhich shape the encoders emit; endpoint modules pick the right value at the\ncall site.\n\n@docs Filter, eq, neq, in_, nin, contains, gt, gte, lt, lte, custom\n@docs Sort, asc, desc\n@docs Range, range, limit, offset\n@docs Timeframe, relative, between\n@docs Dialect, standard, assetInventory\n@docs encodeFilter, encodeSort, encodeRange, encodeTimeframe\n\n","unions":[{"name":"Dialect","comment":" Selects which `request_data` wire shape the encoders emit. Pick one with\n[`standard`](#standard) (the default for almost every Cortex endpoint) or\n[`assetInventory`](#assetInventory) (the `POST /public_api/v1/assets`\ninventory endpoint and the cloud-API list endpoints, which use uppercase\n`SEARCH_FIELD`/`SEARCH_TYPE`/`SEARCH_VALUE` filters and a sort array).\n","args":[],"cases":[]},{"name":"Filter","comment":" A single `{field, operator, value}` filter entry. Multiple filters sent on\none request are AND-ed together by the server.\n","args":[],"cases":[]},{"name":"Range","comment":" Pagination window over the result set. The server reads this as\n`search_from` / `search_to` row indices (0-based, exclusive on the upper\nbound).\n","args":[],"cases":[]},{"name":"Sort","comment":" Sort directive — a field name and direction keyword.\n","args":[],"cases":[]},{"name":"Timeframe","comment":" Time window for list/search queries. [`relative`](#relative) is a\nduration in epoch-milliseconds measured backward from \"now\"; [`between`](#between)\nis an absolute `from`/`to` epoch-millisecond window.\n","args":[],"cases":[]}],"aliases":[],"values":[{"name":"asc","comment":" Ascending sort on the given field.\n","type":"String.String -> Cortex.Query.Sort"},{"name":"assetInventory","comment":" The asset-inventory dialect — `{SEARCH_FIELD, SEARCH_TYPE, SEARCH_VALUE}`\nfilters wrapped in `{AND: [...]}` and sort wrapped in a one-element array.\nTimeframes are not supported by this dialect and are dropped silently.\n","type":"Cortex.Query.Dialect"},{"name":"between","comment":" Absolute window — inclusive epoch-millisecond bounds.\n","type":"Basics.Int -> Basics.Int -> Cortex.Query.Timeframe"},{"name":"contains","comment":" Substring filter — `field` contains `value`.\n","type":"String.String -> String.String -> Cortex.Query.Filter"},{"name":"custom","comment":" Escape hatch for operators the SDK has not catalogued yet. The `operator`\nstring is passed through to the wire as-is, and `value` can be any JSON.\n","type":"String.String -> String.String -> Json.Encode.Value -> Cortex.Query.Filter"},{"name":"desc","comment":" Descending sort on the given field.\n","type":"String.String -> Cortex.Query.Sort"},{"name":"encodeFilter","comment":" Encode a [`Filter`](#Filter) in the given [`Dialect`](#Dialect)'s wire\nrepresentation. The Standard dialect emits `{field, operator, value}` with\nlowercase operators; the AssetInventory dialect emits `{SEARCH_FIELD,\nSEARCH_TYPE, SEARCH_VALUE}` with uppercase operators.\n","type":"Cortex.Query.Dialect -> Cortex.Query.Filter -> Json.Encode.Value"},{"name":"encodeRange","comment":" Encode a [`Range`](#Range) as the two-field `{search_from, search_to}`\npair expected inside `request_data`. Returned as a list so callers can splice\nit into the enclosing object.\n","type":"Cortex.Query.Range -> List.List ( String.String, Json.Encode.Value )"},{"name":"encodeSort","comment":" Encode a [`Sort`](#Sort) in the given [`Dialect`](#Dialect)'s wire\nrepresentation. The Standard dialect emits `{field, keyword: \"asc\"|\"desc\"}`;\nthe AssetInventory dialect emits `{FIELD, ORDER: \"ASC\"|\"DESC\"}` (the\nenclosing array wrapping is applied by [`Cortex.RequestData.encode`](Cortex-RequestData#encode)).\n","type":"Cortex.Query.Dialect -> Cortex.Query.Sort -> Json.Encode.Value"},{"name":"encodeTimeframe","comment":" Encode a [`Timeframe`](#Timeframe) to its wire representation.\n","type":"Cortex.Query.Timeframe -> Json.Encode.Value"},{"name":"eq","comment":" Equality filter — `field == value`.\n","type":"String.String -> String.String -> Cortex.Query.Filter"},{"name":"gt","comment":" Greater-than filter.\n","type":"String.String -> Basics.Int -> Cortex.Query.Filter"},{"name":"gte","comment":" Greater-than-or-equal filter.\n","type":"String.String -> Basics.Int -> Cortex.Query.Filter"},{"name":"in_","comment":" Membership filter — `field` is one of the given values. Named with a\ntrailing underscore because `in` is a reserved word in Elm.\n","type":"String.String -> List.List String.String -> Cortex.Query.Filter"},{"name":"limit","comment":" First `n` rows — sugar for `range 0 n`.\n","type":"Basics.Int -> Cortex.Query.Range"},{"name":"lt","comment":" Less-than filter.\n","type":"String.String -> Basics.Int -> Cortex.Query.Filter"},{"name":"lte","comment":" Less-than-or-equal filter.\n","type":"String.String -> Basics.Int -> Cortex.Query.Filter"},{"name":"neq","comment":" Inequality filter — `field /= value`.\n","type":"String.String -> String.String -> Cortex.Query.Filter"},{"name":"nin","comment":" Non-membership filter — `field` is none of the given values.\n","type":"String.String -> List.List String.String -> Cortex.Query.Filter"},{"name":"offset","comment":" `n` rows starting at `start`.\n","type":"Basics.Int -> Basics.Int -> Cortex.Query.Range"},{"name":"range","comment":" Rows in `[from, to)`. Use [`limit`](#limit) for the common case of \"first\nN rows\".\n","type":"Basics.Int -> Basics.Int -> Cortex.Query.Range"},{"name":"relative","comment":" Last `n` milliseconds — e.g. `relative 86400000` is the last 24 hours.\n","type":"Basics.Int -> Cortex.Query.Timeframe"},{"name":"standard","comment":" The default dialect used by most Cortex Advanced API list/search\nendpoints — `{field, operator, value}` filters and `{field, keyword}` sort.\n","type":"Cortex.Query.Dialect"}],"binops":[]},{"name":"Cortex.Request","comment":" Opaque request descriptor. Each `Cortex.Api.*` module builds a\n`Request a` describing the endpoint to hit and how to decode its response;\n[`Cortex.Client.send`](Cortex-Client#send) is what actually dispatches it.\n\nOnly `GET` and `POST` are provided — the Cortex Advanced API does not use\n`PUT`, `PATCH`, or `DELETE`, so adding those verbs would be dead code.\n\n@docs Request\n@docs get, post, postEmpty\n@docs map, withDecoder\n@docs toInternal\n\n","unions":[{"name":"Request","comment":" A pending HTTP request paired with its response decoder. Opaque so the\nwire format stays an implementation detail of the SDK.\n","args":["a"],"cases":[]}],"aliases":[],"values":[{"name":"get","comment":" Build a GET request from a path (as a list of segments) and a response\ndecoder.\n","type":"List.List String.String -> Json.Decode.Decoder a -> Cortex.Request.Request a"},{"name":"map","comment":" Transform the decoded response value. Useful for wrapping a typed result\ninto a different shape before it reaches your `update`.\n","type":"(a -> b) -> Cortex.Request.Request a -> Cortex.Request.Request b"},{"name":"post","comment":" Build a POST request from a path, a JSON body, and a response decoder.\n","type":"List.List String.String -> Json.Encode.Value -> Json.Decode.Decoder a -> Cortex.Request.Request a"},{"name":"postEmpty","comment":" POST with the empty advanced-API envelope `{\"request_data\": {}}` as the\nbody. Used by endpoints that take no filters or paging arguments.\n","type":"List.List String.String -> Json.Decode.Decoder a -> Cortex.Request.Request a"},{"name":"toInternal","comment":" Extract the raw method/path/query/body/decoder record. Intended as an\nescape hatch for [`Cortex.Client.toRequestRecord`](Cortex-Client#toRequestRecord)\nand custom dispatchers; most consumers should not need this.\n","type":"Cortex.Request.Request a -> { method : String.String, path : List.List String.String, query : List.List ( String.String, String.String ), body : Json.Encode.Value, decoder : Json.Decode.Decoder a }"},{"name":"withDecoder","comment":" Replace the response decoder entirely. Useful when a caller wants the\nraw JSON (for logging, cache, or piping to another tool) instead of the\ntyped shape the endpoint module provides: `Request.withDecoder Decode.value\nreq` turns any `Request a` into a `Request Value`.\n","type":"Json.Decode.Decoder b -> Cortex.Request.Request a -> Cortex.Request.Request b"}],"binops":[]},{"name":"Cortex.RequestData","comment":" Envelope builder for Cortex Advanced API endpoints that accept the\nstandard `filters` / `sort` / `search_from`/`search_to` / `timeframe` shape.\n\nEndpoint modules take a typed args record, map it into a\n[`Standard`](#Standard), and call [`encode`](#encode) with the appropriate\n[`Cortex.Query.Dialect`](Cortex-Query#Dialect) — that single call produces\nthe full `{\"request_data\": {...}}` body. The `extra` field is an escape\nhatch for endpoint-specific keys or new Cortex fields the SDK has not\nmodeled yet; its pairs are merged in last, so they override any\nSDK-generated key on collision.\n\n@docs Standard, empty, encode\n\n","unions":[],"aliases":[{"name":"Standard","comment":" The standard inner shape of `request_data`. Every field is optional at\nthe wire level — omitted `Maybe`s and the empty `filters`/`extra` lists drop\nout of the encoded body.\n","args":[],"type":"{ filters : List.List Cortex.Query.Filter, sort : Maybe.Maybe Cortex.Query.Sort, range : Maybe.Maybe Cortex.Query.Range, timeframe : Maybe.Maybe Cortex.Query.Timeframe, extra : List.List ( String.String, Json.Encode.Value ) }"}],"values":[{"name":"empty","comment":" A [`Standard`](#Standard) with no fields set — encodes to\n`{\"request_data\": {}}` regardless of dialect.\n","type":"Cortex.RequestData.Standard"},{"name":"encode","comment":" Encode a [`Standard`](#Standard) as the `{\"request_data\": {...}}`\nenvelope ready to hand to [`Cortex.Request.post`](Cortex-Request#post).\n\nThe [`Dialect`](Cortex-Query#Dialect) controls the wire shape of `filters`\nand `sort` and which fields are emitted: the\n[`Cortex.Query.standard`](Cortex-Query#standard) dialect emits flat\n`{field, operator, value}` filters, a single `{field, keyword}` sort\nobject, and the optional `timeframe`; the\n[`Cortex.Query.assetInventory`](Cortex-Query#assetInventory) dialect wraps\nfilters in `{AND: [...]}` with uppercase `SEARCH_FIELD`/`SEARCH_TYPE`/\n`SEARCH_VALUE` keys, wraps sort in a one-element array of `{FIELD, ORDER}`,\nand drops `timeframe` (the asset-inventory endpoint does not accept it).\n\n`range` and `extra` behave identically across dialects.\n\n","type":"Cortex.Query.Dialect -> Cortex.RequestData.Standard -> Json.Encode.Value"}],"binops":[]}]