Unavailable. Nobody can download this version any more, with elm or with the Lamdera compiler: github.com/vanhecke/celmex is gone (deleted or private); Software Heritage not asked yet (this run's --swh-calls were used up); no fork with the same repo name found; no cached copy. Use another version.
Cortex issue records (alerts/incidents) and their tenant-defined schema.
The /public_api/v1/issue/search endpoint returns a paginated list of
Issue records — each with ~50 normalized fields covering issue
identity, detection metadata, asset references, MITRE ATT&CK mapping,
status/resolution lifecycle, and assignment. The /public_api/v1/issue/schema
endpoint returns the field schema (field_name, field_pretty_name,
data_type) for every issue field — including custom fields the tenant has
defined.
A SearchArgs with no filters, sort, pagination, or
timeframe.
A single issue record. All fields are Maybe because population varies
by detection method, tenant, and feature flags. Field names use the live
wire format (dotted namespacing for detection.* / status.*), with
oneOf fallback to spec-form underscore names for forward compat.
normalizedFields (~70 XDM-prefixed forensic fields) and customFields
(tenant-defined arbitrary keys) are preserved verbatim — the former is
fully populated only for advanced detection methods and is best surfaced
as raw JSON until typed sub-records are added; the latter is unconstrained
per tenant configuration and cannot be typed at the SDK layer.
Paginated response from search. The live API returns
DATA/TOTAL_COUNT/FILTER_COUNT (uppercase); the spec documents
issues/total_count/result_count (lowercase). Both are accepted.
One row of the issue field-schema response from schema.
POST /public_api/v1/issue/search
Retrieve issues matching the given filters, sort, pagination, and
timeframe. Returns a SearchResponse with the typed
Issue records and pagination counts.
Arguments to
search. All fields are optional; passdefaultSearchArgsfor an unfiltered request.extrais merged last intorequest_dataand overrides any SDK-generated key on collision — use it for request fields the SDK has not modeled yet.