openapi: 3.2.0
info:
  contact:
    email: support@paloaltonetworks.com
  description: 'This Open API spec file represents the APIs available for

    [Palo Alto Networks Aggregate Monitoring](https://docs.paloaltonetworks.com/NEED-URL) APIs.


    After you have configured your tenants, these APIs can be used to perform aggregated monitoring queries for information about applications, threats, URLs, and licenses across all your tenants of a Prisma Access or Prisma SD-WAN instance.


    These APIs use the common SASE authentication mechanism and base URL. See the

    [Prisma SASE API Get Started](https://pan.dev/sase/docs/getstarted) guide for more information.


    This Open API spec file was created on October 01, 2024. To check for a more recent version of this file, see

    [Aggregate Monitoring APIs on pan.dev](https://pan.dev/sase/api/mt-monitor/).


    © 2024 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo

    Alto Networks. A list of our trademarks can be found at


    [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html)


    All other marks mentioned herein may be trademarks of their respective companies.

    '
  title: Aggreagate Monitoring Data Resource API API
  version: '1.0'
servers:
- url: https://api.sase.paloaltonetworks.com
tags:
- description: "Data Resource \n"
  name: Data Resource API
paths:
  /mt/monitor/v1/agg/alerts:
    post:
      description: "Retrieve an aggregated count of alerts across tenants.                            \n"
      operationId: post-mt-monitor-v1-agg-alerts
      parameters:
      - description: 'Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned.

          '
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.  \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Alerts Count By Tenant:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: domain
                      values:
                      - External
                      - external
                    - operator: last_n_days
                      property: updated_time
                      values:
                      - 7
                  properties:
                  - property: sub_tenant_id
                  - alias: count
                    function: count
                    property: alert_id
              Alerts Distribution By Severity:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: domain
                      values:
                      - External
                      - external
                    - operator: last_n_days
                      property: updated_time
                      values:
                      - 7
                  properties:
                  - property: severity
                  - alias: count
                    function: count
                    property: alert_id
                    sort:
                      order: desc
              Alerts Trend:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: domain
                      values:
                      - External
                      - external
                    - operator: last_n_days
                      property: updated_time
                      values:
                      - 7
                  histogram:
                    enableEmptyInterval: false
                    property: updated_time
                    range: day
                    value: '1'
                  properties:
                  - alias: count
                    function: count
                    property: alert_id
                    sort:
                      order: desc
            schema:
              $ref: '#/components/schemas/RequestBody_Resource'
      responses:
        '200':
          content:
            application/json:
              examples:
                Alerts Count By Tenant:
                  value:
                  - count: 10
                    sub_tenant_id: <sub_tenant_id>
                Alerts Distribution By Severity:
                  value:
                  - count: 3
                    severity: <severity>
                Alerts Trend:
                  value:
                  - count: 1
                    updated_time: 1657238400000
                  - count: 1
                    updated_time: 1657411200000
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List alert count
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/alerts/list:
    post:
      description: "Retrieve an aggregated list of alert counts by source across tenants.               \n"
      operationId: post-mt-monitor-v1-agg-alerts-list
      parameters:
      - description: 'Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned.

          '
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.  \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Alerts Count By Source:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: domain
                      values:
                      - External
                      - external
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: total_count
                  - property: mu_count
                  - property: rn_count
                  - property: sc_count
            schema:
              $ref: '#/components/schemas/RequestBody_Alert'
      responses:
        '200':
          content:
            application/json:
              examples:
                Alerts Count By Source:
                  value:
                  - mu_count: 10
                    rn_count: 10
                    sc_count: 10
                    total_count: 10
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List alerts by source
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/applicationUsage:
    post:
      description: "Retrieve a list of application usage by application type.                   \n"
      operationId: post-mt-monitor-v1-agg-applicationusage
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.  \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Risky Application Usage Trend:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                    - rule: app_risky
                  histogram:
                    enableEmptyInterval: false
                    property: event_time
                    range: day
                    value: '1'
                  properties:
                  - alias: total_bytes_usage
                    function: sum
                    property: total_bytes
              Top Application Categories by Data Usage:
                value:
                  count: 5
                  filter:
                    operator: AND
                    rules:
                    - operator: is_not_null
                      property: app_sub_category
                    - operator: not_equals
                      property: app_sub_category
                      values:
                      - ''
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                  properties:
                  - alias: app_usage
                    function: sum
                    property: total_bytes
                    sort:
                      order: desc
                  - property: app_sub_category
              Top Apps by Data:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                    - operator: is_not_null
                      property: app
                    - operator: not_equals
                      property: app
                      values:
                      - ''
                  properties:
                  - property: app
                  - alias: unique_count
                    function: distinct_count
                    property: app
                  - alias: total_bytes_usage
                    function: sum
                    property: total_bytes
            schema:
              $ref: '#/components/schemas/RequestBody_Resource'
      responses:
        '200':
          content:
            application/json:
              examples:
                Risky Application Usage Trend:
                  value:
                  - event_time: <time in ms>
                    total_bytes_usage: 100
                Top Application Categories by Data Usage:
                  value:
                  - app_sub_category: <app-sub-category>
                    app_usage: 100
                Top Apps by Data:
                  value:
                  - app: <app-name>
                    total_bytes_usage: 10
                    unique_count: 1
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List application usage by type
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/applications:
    post:
      description: "Retrieve an aggregated count of applications across tenants.                                      \n"
      operationId: post-mt-monitor-v1-agg-applications
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.   \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Security Rules and Risky Apps:
                value:
                  count: 4
                  filter:
                    operator: AND
                    rules:
                    - rule: app_risky
                    - operator: not_equals
                      property: rule_matched
                      values:
                      - ''
                    - operator: is_not_null
                      property: rule_matched
                    - rule: unblocked
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                  properties:
                  - property: sub_tenant_id
                  - alias: count
                    function: sum
                    property: app_count
                    sort:
                      order: desc
                  - alias: rule_name
                    property: rule_matched
              Top Applications By Connection:
                value:
                  count: 5
                  filter:
                    operator: AND
                    rules:
                    - operator: is_not_null
                      property: app_category
                    - operator: not_equals
                      property: app_category
                      values:
                      - ''
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                  properties:
                  - alias: total_sessions
                    function: count
                    property: session_id
                    sort:
                      order: desc
                  - property: app_category
                  - property: sub_tenant_id
              Top Users Accessing Risky Apps:
                value:
                  count: 4
                  filter:
                    operator: AND
                    rules:
                    - operator: not_equals
                      property: source_user_info_name
                      values:
                      - ''
                    - operator: is_not_null
                      property: source_user_info_name
                    - rule: app_risky
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                  properties:
                  - alias: count
                    function: sum
                    property: app_count
                    sort:
                      order: desc
                  - alias: user_name
                    property: source_user_info_name
                  - property: sub_tenant_id
            schema:
              $ref: '#/components/schemas/RequestBody_Resource'
      responses:
        '200':
          content:
            application/json:
              examples:
                Security Rules and Risky Apps:
                  value:
                  - count: 100
                    rule_name: <rule-name>
                    sub_tenant_id: <sub-tenant-id>
                Top Applications By Connection:
                  value:
                  - app_category: <app-category>
                    sub_tenant_id: <sub-tenant-id>
                    total_sessions: 100
                Top Users Accessing Risky Apps:
                  value:
                  - count: 12
                    sub_tenant_id: <sub-tenant-id>
                    user_name: <user-name>
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List application count
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/applications/list:
    post:
      description: "Retrieve an aggregated list of applications across tenants.                                    \n"
      operationId: post-mt-monitor-v1-agg-applications-list
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.  \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Applications List:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: sub_tenant_id
                  - property: unique_total_apps
                  - property: risk_of_app_count
                  - property: blocked_app_count
            schema:
              $ref: '#/components/schemas/RequestBody_Application'
      responses:
        '200':
          content:
            application/json:
              examples:
                Applications List:
                  value:
                  - blocked_app_count: 10
                    risk_of_app_count: '3'
                    sub_tenant_id: '1234'
                    unique_total_apps: '2'
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List applications
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/applications/source:
    post:
      description: "Retrieve an aggregated count of applications by source across tenants, such as: remote networks, mobile users, or proxy nodes.                   \n"
      operationId: post-mt-monitor-v1-agg-applications-source
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.  \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Risky Application Count by Source:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: total_app_count
                  - property: total_app_remote_network
                  - property: total_app_mobile_users
                  - property: total_app_proxy_nodes
              Risky Application Count by Source per Tenant:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: sub_tenant_id
                  - property: total_app_count
                  - property: total_app_remote_network
                  - property: total_app_mobile_users
                  - property: total_app_proxy_nodes
            schema:
              $ref: '#/components/schemas/RequestBody_AppSrc'
      responses:
        '200':
          content:
            application/json:
              examples:
                Risky Application Count by Source:
                  value:
                  - total_app_count: 10
                    total_app_mobile_users: 10
                    total_app_proxy_nodes: 10
                    total_app_remote_network: 10
                Risky Application Count by Source per Tenant:
                  value:
                  - sub_tenant_id: <sub_tenant_id>
                    total_app_count: 10
                    total_app_mobile_users: 10
                    total_app_proxy_nodes: 10
                    total_app_remote_network: 10
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List applications by source
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/applications/summary:
    post:
      description: "Retrieve an aggregated summary count of risky applications across tenants.                   \n"
      operationId: post-mt-monitor-v1-agg-applications-summary
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.  \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Blocked Risky Apps:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: total_app_count
                  - property: risk_of_app_count
                  - property: blocked_app_count
              Top Tenants using Risky Applications:
                value:
                  count: 4
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                  properties:
                  - property: sub_tenant_id
                  - alias: value
                    property: risk_of_app_count
                    sort:
                      order: desc
              Total Risky Apps:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: total_app_count
                  - property: risk_of_app_count
              Total Risky Apps Per Tenant:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: sub_tenant_id
                  - property: total_app_count
                  - property: risk_of_app_count
              Unblocked Risky Apps:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: total_app_count
                  - property: risk_of_app_count
                  - property: unblocked_app_count
            schema:
              $ref: '#/components/schemas/RequestBody_AppSummary'
      responses:
        '200':
          content:
            application/json:
              examples:
                Blocked Risky Apps:
                  value:
                  - blocked_apps_count: 10
                    risk_of_app_count: 10
                    total_app_count: 10
                Top Tenants using Risky Applications:
                  value:
                  - sub_tenant_id: <sub-tenant-id>
                    value: 6
                Total Risky Apps:
                  value:
                  - risk_of_app_count: 10
                    total_app_count: 10
                Total Risky Apps Per Tenant:
                  value:
                  - risk_of_app_count: 10
                    sub_tenant_id: <sub_tenant_id>
                    total_app_count: 10
                Unblocked Risky Apps:
                  value:
                  - risk_of_app_count: 10
                    total_app_count: 10
                    unblocked_apps_count: 10
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List app summary
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/incidents/count:
    post:
      description: Get incident count by severity
      operationId: post-mt-monitor-v1-agg-incidents-count
      parameters:
      - description: The value should be 'tenant'(if you want aggregated results across all child tenants) or empty.
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Incidents Count By Severity:
                value:
                  filter:
                    rules:
                    - operator: last_n_days
                      property: raised_time
                      values:
                      - '1'
                    - operator: equals
                      property: status
                      values:
                      - Raised
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - Warning
                    - operator: in
                      property: domain
                      values:
                      - External
                      - external
                  properties:
                  - property: total_count
                  - property: critical_count
                  - property: warning_count
            schema:
              $ref: '#/components/schemas/RequestBody_Incidents'
      responses:
        '200':
          content:
            application/json:
              examples:
                Incidents Count By Severity:
                  value:
                  - critical_count: 10
                    total_count: 20
                    warning_count: 10
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: Get incident count by severity
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/incidents/impactedList:
    post:
      description: Get list of impacted objects
      operationId: post-mt-monitor-v1-agg-incidents-impactedlist
      parameters:
      - description: The value should be 'tenant'(if you want aggregated results across all child tenants) or empty.
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              List Of Impacted Objects:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - '60'
                    - operator: in
                      property: incident_id
                      values:
                      - f2e7e5b7-c635-41e9-abfa-06697a382ebf
            schema:
              $ref: '#/components/schemas/RequestBody_Incidents'
      responses:
        '200':
          content:
            application/json:
              examples:
                List Of Impacted Objects:
                  value:
                  - bgp_peers:
                    - BGP1
                    impacted_list: result
                    locations:
                    - LocationA
                    sites:
                    - SiteA
                    tunnels:
                    - TunnelA
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: Get list of impacted objects
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/incidents/list:
    post:
      description: Get list of incidents
      operationId: post-mt-monitor-v1-agg-incidents-list
      parameters:
      - description: The value should be 'tenant'(if you want aggregated results across all child tenants) or empty.
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              List Of Incidents:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: updated_time
                      values:
                      - 1
                    - operator: in
                      property: domain
                      values:
                      - External
                      - external
                  properties:
                  - property: incident_id
                  - property: title
                  - property: sub_tenant_id
                  - property: severity
                  - property: category
                  - property: sub_category
                  - property: status
                  - property: created_time
                  - property: updated_time
                  - property: code
                  - property: clear_reason
            schema:
              $ref: '#/components/schemas/RequestBody_Incidents'
      responses:
        '200':
          content:
            application/json:
              examples:
                List Of Incidents:
                  value:
                  - category: Prisma-Access
                    clear_reason: Auto
                    code: AL_ABC
                    created_time: 123456789
                    incident_id: '34898'
                    severity: Warning
                    status: Raised
                    sub-category: sub-category
                    sub_tenant_id: 12345
                    title: Tunnel1 is down
                    updated_time: 9876543
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: Get list of incidents
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/incidents/tenants:
    post:
      description: Get top tenants by incidents count(open critical + warning)
      operationId: post-mt-monitor-v1-agg-incidents-tenants
      parameters:
      - description: The value should be 'tenant'(if you want aggregated results across all child tenants) or empty.
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Top Tenants By Incidents:
                value:
                  count: 5
                  filter:
                    rules:
                    - operator: last_n_days
                      property: raised_time
                      values:
                      - '1'
                    - operator: equals
                      property: status
                      values:
                      - Raised
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - Warning
                    - operator: in
                      property: domain
                      values:
                      - External
                      - external
                  properties:
                  - property: sub_tenant_id
                  - property: total_count
                  - property: critical_count
                  - property: warning_count
            schema:
              $ref: '#/components/schemas/RequestBody_Incidents'
      responses:
        '200':
          content:
            application/json:
              examples:
                Top Tenants By Incidents:
                  value:
                  - critical_count: 10
                    sub_tenant_id: 123456
                    total_count: 20
                    warning_count: 10
                  - critical_count: 20
                    sub_tenant_id: 5678768
                    total_count: 30
                    warning_count: 10
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: Get top tenants by incidents count
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/incidents/trends:
    post:
      description: Get incident count histogram
      operationId: post-mt-monitor-v1-agg-incidents-trends
      parameters:
      - description: The value should be 'tenant'(if you want aggregated results across all child tenants) or empty.
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Cleared Incidents Histogram:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: cleared_time
                      values:
                      - '1'
                    - operator: equals
                      property: status
                      values:
                      - Cleared
                    - operator: in
                      property: domain
                      values:
                      - External
                      - external
                  histogram:
                    enableEmptyInterval: true
                    property: cleared_time
                    range: minute
                    value: '5'
              Open Critical Incidents Histogram:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: raised_time
                      values:
                      - '1'
                    - operator: equals
                      property: status
                      values:
                      - Raised
                    - operator: equals
                      property: severity
                      values:
                      - Critical
                    - operator: in
                      property: domain
                      values:
                      - External
                      - external
                  histogram:
                    enableEmptyInterval: true
                    property: raised_time
                    range: minute
                    value: '5'
              Open Warning Incidents Histogram:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: raised_time
                      values:
                      - '1'
                    - operator: equals
                      property: status
                      values:
                      - Raised
                    - operator: equals
                      property: severity
                      values:
                      - Warning
                    - operator: in
                      property: domain
                      values:
                      - External
                      - external
                  histogram:
                    enableEmptyInterval: true
                    property: raised_time
                    range: minute
                    value: '5'
            schema:
              $ref: '#/components/schemas/RequestBody_Incidents'
      responses:
        '200':
          content:
            application/json:
              examples:
                Cleared Incidents Histogram:
                  value:
                  - cleared_time: 234567890
                    count: 10
                    histogram_time: 234567890
                  - cleared_time: 73987654
                    count: 10
                    histogram_time: 73987654
                Open Critical Incidents Histogram:
                  value:
                  - count: 10
                    histogram_time: 234567890
                    raised_time: 234567890
                  - count: 10
                    histogram_time: 73987654
                    raised_time: 73987654
                Open Warning Incidents Histogram:
                  value:
                  - count: 10
                    histogram_time: 234567890
                    raised_time: 234567890
                  - count: 10
                    histogram_time: 73987654
                    raised_time: 73987654
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: Get incident trends(open critical, open warning, closed incidents)
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/location/list:
    get:
      description: Get list of compute locations, latitude and longitude
      operationId: get-mt-monitor-v1-agg-location-list
      parameters:
      - description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Location List:
                  value:
                  - cloudRegionName: hong-kong
                    latitude: '22.3193'
                    locationName: Hong Kong
                    longitude: '114.1694'
                  - cloudRegionName: ap-northeast-1
                    latitude: '36.2048'
                    locationName: Japan Central
                    longitude: '138.2529'
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: Get Location List
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/locationsTenants:
    post:
      description: Get number of tenants with assets at a specific compute location
      operationId: post-mt-monitor-v1-agg-locationstenants
      parameters:
      - description: The value should be 'tenant'(if you want aggregated results across all child tenants) or empty.
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Tenant Count at Location:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 1
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US Central
                  properties:
                  - alias: unique_tenant_count
                    operator: distinct_count
                    property: sub_tenant_id
            schema:
              $ref: '#/components/schemas/RequestBody_Resource'
      responses:
        '200':
          content:
            application/json:
              examples:
                Tenant Count at Location:
                  value:
                  - unique_tenant_count: 100
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: Get number of tenants at location
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/locationsUsers:
    post:
      description: Get number of users at or across compute locations
      operationId: post-mt-monitor-v1-agg-locationsusers
      parameters:
      - description: The value should be 'tenant'(if you want aggregated results across all child tenants) or empty.
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              User Count across Locations:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 90
                    - operator: in
                      property: connection_state
                      values:
                      - - CONNECTED
                        - CONNECT_CONTINUE
                    - operator: equals
                      property: node_type
                      values:
                      - 49
                  properties:
                  - property: compute_location
                  - alias: unique_user_count
                    operator: distinct_count
                    property: gpuser_name
              User Count at Location:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 90
                    - operator: in
                      property: connection_state
                      values:
                      - - CONNECTED
                        - CONNECT_CONTINUE
                    - operator: equals
                      property: node_type
                      values:
                      - 49
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US Central
                  properties:
                  - alias: unique_user_count
                    operator: distinct_count
                    property: gpuser_name
            schema:
              $ref: '#/components/schemas/RequestBody_Resource'
      responses:
        '200':
          content:
            application/json:
              examples:
                User Count across Locations:
                  value:
                  - compute_location: US Central
                    unique_user_count: 10
                  - compute_location: US West
                    unique_user_count: 100
                  - compute_location: US East
                    unique_user_count: 1000
                User Count at Location:
                  value:
                  - unique_user_count: 100
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: Get number of users at location(s)
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/resource:
    post:
      description: "Retrieve aggregated network inventory across tenants.                    \n"
      operationId: post-mt-monitor-v1-agg-resource
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.   \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Network Inventory Count:
                value:
                  properties:
                  - property: node_type
                  - alias: node_count
                    function: count
                    property: node_type
            schema:
              $ref: '#/components/schemas/RequestBody_Resource'
      responses:
        '200':
          content:
            application/json:
              examples:
                Network Inventory Count:
                  value:
                  - node_count: 30
                    node_type: 48
                  - node_count: 10
                    node_type: 49
                  - node_count: 10
                    node_type: 50
                  - node_count: 4
                    node_type: 51
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List network inventory count
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/serviceConnectivity:
    post:
      description: "Retrieve an aggregated list of Remote Network (RN) and Service Connection (SC) status count across tenants.                    \n"
      operationId: post-mt-monitor-v1-agg-serviceconnectivity
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: 'Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.

          '
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Site Status:
                value:
                  filter:
                    rules:
                    - operator: in
                      property: node_type
                      values:
                      - 51
                      - 48
                    - operator: in
                      property: site_state_name
                      values:
                      - Up
                      - Down
                  properties:
                  - property: node_type
                  - property: sub_tenant_id
                  - alias: count
                    function: distinct_count
                    property: site_name
              Site Status per Tenant:
                value:
                  filter:
                    rules:
                    - operator: in
                      property: node_type
                      values:
                      - 51
                      - 48
                    - operator: in
                      property: site_state_name
                      values:
                      - Up
                      - Down
                  properties:
                  - property: site_state_name
                  - property: node_type
                  - property: sub_tenant_id
                  - alias: count
                    function: distinct_count
                    property: site_name
            schema:
              $ref: '#/components/schemas/RequestBody_Resource'
      responses:
        '200':
          content:
            application/json:
              examples:
                Site Status:
                  value:
                  - count: 1
                    node_type: 48
                    site_state_name: Down
                  - count: 1
                    node_type: 51
                    site_state_name: Up
                Site Status per Tenant:
                  value:
                  - count: 1
                    node_type: 48
                    site_state_name: Down
                    sub_tenant_id: '9000000006'
                  - count: 1
                    node_type: 51
                    site_state_name: Up
                    sub_tenant_id: '9000000006'
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List RN and SC site status count
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/serviceConnectivity/cdlStatus:
    post:
      description: "Retrieve an aggregated list of Cortex Data Lake (CDL) connectivity status across tenants.                    \n"
      operationId: post-mt-monitor-v1-agg-serviceconnectivity-cdlstatus
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.                        \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Cortex Data Lake Connections:
                value:
                  filter:
                    rules:
                    - operator: in
                      property: state
                      values:
                      - Up
                      - Down
                  properties:
                  - property: status
                  - property: location_count
              Cortex Data Lake Connections per Tenant:
                value:
                  filter:
                    rules:
                    - operator: in
                      property: state
                      values:
                      - Up
                      - Down
                  properties:
                  - property: status
                  - property: location_count
                  - property: sub_tenant_id
            schema:
              $ref: '#/components/schemas/RequestBody_CDLStatus'
      responses:
        '200':
          content:
            application/json:
              examples:
                Cortex Data Lake Connections:
                  value:
                  - location_count: 100
                    status: <status>
                Cortex Data Lake Connections per Tenant:
                  value:
                  - location_count: 100
                    status: <status>
                    sub_tenant_id: <sub_tenant_id>
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List CDL connectivity status
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/serviceConnectivity/gatewayStatus:
    post:
      description: "Retrieve an aggregated list of mobile gateway connection status across tenants.                    \n"
      operationId: post-mt-monitor-v1-agg-serviceconnectivity-gatewaystatus
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region. \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Gateway Locations:
                value:
                  properties:
                  - property: status
                  - property: gateway_count
              Gateway Locations per Tenant:
                value:
                  properties:
                  - property: status
                  - property: gateway_count
                  - property: sub_tenant_id
            schema:
              $ref: '#/components/schemas/RequestBody_GatewayStatus'
      responses:
        '200':
          content:
            application/json:
              examples:
                Gateway Locations:
                  value:
                  - gateway_count: 100
                    status: <status>
                Gateway Locations per Tenant:
                  value:
                  - gateway_count: 100
                    status: <status>
                    sub_tenant_id: <sub_tenant_id>
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List mobile gateway connection status
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/serviceConnectivity/licenseAllocated:
    get:
      description: "Get an aggregated list of Global Protect (GP) licenses allocated across tenants for `mobile_users`, `explicit_proxy`, `okyo`, and  `remote_networks`.                    \n"
      operationId: get-mt-monitor-v1-agg-serviceconnectivity-licenseallocated
      parameters:
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region. \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                Total GP License Allocated:
                  value:
                  - explicit_proxy:
                      size: 0
                      unit: user
                    mobile_users:
                      size: 10000
                      unit: user
                    okyo:
                      size: 0
                      unit: user
                    remote_networks:
                      size: 10000
                      unit: mbps
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: Get total GP licenses allocated
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/serviceConnectivity/topOutliers:
    post:
      description: "Retrieve an aggregated list of top outlier sites that consume more bandwidth than allocated.                    \n"
      operationId: post-mt-monitor-v1-agg-serviceconnectivity-topoutliers
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.  \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Top Outliers:
                value:
                  count: 5
                  filter:
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 45
                    - operator: gt
                      property: threshold
                      values:
                      - 80
                    - operator: in
                      property: node_type
                      values:
                      - 48
                  properties:
                  - property: site_name
                  - property: bandwidth_consumed
                  - property: unit
            schema:
              $ref: '#/components/schemas/RequestBody_Outliers'
      responses:
        '200':
          content:
            application/json:
              examples:
                Top Outliers:
                  value:
                  - bandwidth_consumed: 10
                    site_name: <site_name>
                    unit: Kbps
                  - bandwidth_consumed: 100
                    count: 9
                    site_name: <site_name>
                    unit: Kbps
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List top outliers
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/serviceConnectivity/uniqueUsers:
    post:
      description: "Retrieve an aggregated list of unique Global Protect (GP) users connected in the last 90 days.                  \n"
      operationId: post-mt-monitor-v1-agg-serviceconnectivity-uniqueusers
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.   \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Unique Users GP:
                value:
                  properties:
                  - property: user_count
            schema:
              $ref: '#/components/schemas/RequestBody_UniqueUsers'
      responses:
        '200':
          content:
            application/json:
              examples:
                Unique Users GP:
                  value:
                  - user_count: 100
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List unique GP users
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/threats:
    post:
      description: "Retrieve an aggregated count of threats across tenants.                    \n"
      operationId: post-mt-monitor-v1-agg-threats
      parameters:
      - description: 'Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned.

          '
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.    \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Security Rules and Unblocked Threats:
                value:
                  count: 4
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                    - operator: is_not_null
                      property: rule_matched
                    - operator: not_equals
                      property: rule_matched
                      values:
                      - ''
                  properties:
                  - property: sub_tenant_id
                  - alias: threat_count
                    function: count
                    property: threat_id
                    sort:
                      order: desc
                  - alias: rule_name
                    property: rule_matched
              Threats Distribution by Threat Type:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                    - operator: is_not_null
                      property: threat_sub_type
                    - operator: not_equals
                      property: threat_sub_type
                      values:
                      - ''
                  properties:
                  - property: threat_sub_type
                  - alias: unique_threat_count
                    function: distinct_count
                    property: threat_id
                  - function: sum
                    property: threat_count
              Threats Trend:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                  histogram:
                    enableEmptyInterval: false
                    property: event_time
                    range: day
                    value: '1'
                  properties:
                  - alias: count
                    function: sum
                    property: threat_count
              Top Users with Critical Threats:
                value:
                  count: 4
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: severity
                      values:
                      - Critical
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                    - operator: is_not_null
                      property: source_user
                    - operator: not_equals
                      property: source_user
                      values:
                      - ''
                  properties:
                  - alias: unique_threat_count
                    function: count
                    property: threat_id
                  - alias: total_threat_count
                    function: sum
                    property: threat_count
                    sort:
                      order: desc
                  - property: source_user
                  - property: source_user_info_name
            schema:
              $ref: '#/components/schemas/RequestBody_Resource'
      responses:
        '200':
          content:
            application/json:
              examples:
                Threats Distribution by Threat Type:
                  value:
                  - threat_count: 10
                    threat_sub_type: <threat_sub_type>
                    unique_threat_count: 5
                Threats Trend:
                  value:
                  - count: 10
                    event_time: <event_time_ms>
                Top Users with Critical Threats:
                  value:
                  - source_user: <source-user>
                    source_user_info_name: <source-user-info-name>
                    total_threat_count: 3999
                    unique_threat_count: 3924
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List threat count
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/threats/list:
    post:
      description: "Retrieve an aggregated list of all threats across tenants.                    \n"
      operationId: post-mt-monitor-v1-agg-threats-list
      parameters:
      - description: 'Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned.

          '
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.                             \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Threat List:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                  properties:
                  - property: sub_tenant_id
                  - property: total_threats
                  - property: blocked_count
                  - property: unblocked_count
                  - property: malicious_count
                  - property: unknown_count
            schema:
              $ref: '#/components/schemas/RequestBody_Threat'
      responses:
        '200':
          content:
            application/json:
              examples:
                Threat List:
                  value:
                  - blocked_count: 10
                    malicious_count: 10
                    sub_tenant_id: <sub_tenant_id>
                    total_threats: 10
                    unblocked_count: 10
                    unknown_count: 10
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List threats
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/threats/source:
    post:
      description: "Retrieve an aggregated count of critical threats by source across tenants, such as: remote networks, mobile users, or proxy nodes.                             \n"
      operationId: post-mt-monitor-v1-agg-threats-source
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.                             \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Threat Count by Source:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: total_threats
                  - property: total_remote_network
                  - property: total_mobile_users
                  - property: total_proxy_nodes
              Threat Count by Source per Tenant:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: sub_tenant_id
                  - property: total_threats
                  - property: total_remote_network
                  - property: total_mobile_users
                  - property: total_proxy_nodes
            schema:
              $ref: '#/components/schemas/RequestBody_ThreatSrc'
      responses:
        '200':
          content:
            application/json:
              examples:
                Threat Count by Source:
                  value:
                  - total_mobile_users: 10
                    total_proxy_nodes: 10
                    total_remote_network: 10
                    total_threats: 10
                Threat Count by Source per Tenant:
                  value:
                  - sub_tenant_id: <sub_tenant_id>
                    total_mobile_users: 10
                    total_proxy_nodes: 10
                    total_remote_network: 10
                    total_threats: 10
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List threats by source
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/threats/summary:
    post:
      description: "Retrieve an aggregated summary of threats across tenants.                  \n"
      operationId: post-mt-monitor-v1-agg-threats-summary
      parameters:
      - description: 'Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned.

          '
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.                              \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Blocked Threats:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: total_threats
                  - property: blocked_count
              Threat Summary:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                  properties:
                  - property: sub_tenant_id
                  - property: total_threats
                  - property: blocked_count
                  - property: unblocked_count
                  - property: malicious_count
                  - property: unknown_count
                  - property: wildfire_verdict
              Top Tenants with Unblocked Threats:
                value:
                  count: 2
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                  properties:
                  - property: sub_tenant_id
                  - alias: total
                    property: total_threats
                  - alias: value
                    property: unblocked_count
                    sort:
                      order: desc
              Total Critical Threats:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                  properties:
                  - property: total_threats
              Total Critical Threats Per Tenant:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                  properties:
                  - property: sub_tenant_id
                  - property: total_threats
              Unblocked Threats:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: total_threats
                  - property: unblocked_count
            schema:
              $ref: '#/components/schemas/RequestBody_ThreatSummary'
      responses:
        '200':
          content:
            application/json:
              examples:
                Blocked Threats:
                  value:
                  - blocked_count: 10
                    total_threats: 10
                Threat Summary:
                  value:
                  - blocked_count: 79760
                    malicious_count: 16654
                    sub_tenant_id: <sub-tenant-id>
                    total_threats: 99574
                    unblocked_count: 19814
                    unknown_count: 0
                    wildfire_verdict: 0
                Top Tenants with Unblocked Threats:
                  value:
                  - sub_tenant_id: <sub-tenant-id>
                    total: 99574
                    value: 19814
                Total Critical Threats:
                  value:
                  - total_threats: 10
                Total Critical Threats Per Tenant:
                  value:
                  - sub_tenant_id: <sub_tenant_id>
                    total_threats: 10
                Unblocked Threats:
                  value:
                  - total_threats: 10
                    unblocked_count: 10
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List threat summary
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/url/summary:
    post:
      description: "Retrieve an aggregated summary count of URLs across tenants.                  \n"
      operationId: post-mt-monitor-v1-agg-url-summary
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.   \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Blocked Risky URL Count:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - alias: count
                    property: blocked_uri_count
              Blocked Risky URL Count By Tenant:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: sub_tenant_id
                  - alias: count
                    property: blocked_uri_count
                    sort:
                      order: desc
              Risky URL Count By Tenant:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: sub_tenant_id
                  - alias: count
                    property: total_uri
                    sort:
                      order: desc
            schema:
              $ref: '#/components/schemas/RequestBody_UrlSummary'
      responses:
        '200':
          content:
            application/json:
              examples:
                Blocked Risky URL Count:
                  value:
                    count: 10
                Blocked Risky URL Count By Tenant:
                  value:
                  - count: 10
                    sub_tenant_id: <sub_tenant_id>
                Risky URL Count By Tenant:
                  value:
                  - count: 10
                    sub_tenant_id: <sub_tenant_id>
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List URL count summary
      tags:
      - Data Resource API
  /mt/monitor/v1/agg/urlLogs:
    post:
      description: "Retrieve top tenants with risky URLs.                  \n"
      operationId: post-mt-monitor-v1-agg-urllogs
      parameters:
      - description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
        example: tenant
        in: query
        name: agg_by
        schema:
          type: string
      - description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region.                                                       \n"
        example: americas
        in: header
        name: X-PANW-Region
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Security Rules and Unblocked Risky Urls:
                value:
                  count: 4
                  filter:
                    operator: AND
                    rules:
                    - rule: url_high_risk
                    - rule: unblocked
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                    - operator: is_not_null
                      property: rule_matched
                    - operator: not_equals
                      property: rule_matched
                      values:
                      - ''
                  properties:
                  - property: sub_tenant_id
                  - function: sum
                    property: uri_count
                    sort:
                      order: desc
                  - alias: rule_name
                    property: rule_matched
              Top Tenants with Risky URLs:
                value:
                  filter:
                    operator: AND
                    rules:
                    - operator: in
                      property: url_category_value
                      values:
                      - high-risk
                      - malware
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 7
                  properties:
                  - property: sub_tenant_id
                  - alias: value
                    function: sum
                    property: uri_count
                    sort:
                      order: desc
              Top Users Accessing Unblocked Risky Urls:
                value:
                  count: 4
                  filter:
                    operator: AND
                    rules:
                    - rule: url_high_risk
                    - operator: last_n_days
                      property: event_time
                      values:
                      - 30
                    - operator: in
                      property: severity
                      values:
                      - Critical
                      - High
                      - Medium
                    - operator: is_not_null
                      property: source_user_info_name
                    - operator: not_equals
                      property: source_user_info_name
                      values:
                      - ''
                  properties:
                  - property: sub_tenant_id
                  - function: sum
                    property: uri_count
                    sort:
                      order: desc
                  - alias: user_name
                    property: source_user_info_name
            schema:
              $ref: '#/components/schemas/RequestBody_Resource'
      responses:
        '200':
          content:
            application/json:
              examples:
                Security Rules and Unblocked Risky Urls:
                  value:
                  - rule_name: <rule-name>
                    sub_tenant_id: <sub-tenant-id>
                    uri_count: 300
                Top Tenants with Risky URLs:
                  value:
                  - sub_tenant_id: <sub_tenant_id>
                    value: 340
                Top Users Accessing Unblocked Risky Urls:
                  value:
                  - sub_tenant_id: <sub-tenant-id>
                    uri_count: 596
                    user_name: <user-name>
          description: Success
        '400':
          description: Bad Request
        '500':
          description: Server Error
      security:
      - Bearer: []
      summary: List top tenants with risky URLs
      tags:
      - Data Resource API
components:
  schemas:
    ThreatProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, total_threats, blocked_count, unblocked_count, malicious_count, unknown_count
          type: string
        sort:
          $ref: '#/components/schemas/Sort'
      type: object
    ThreatFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/ThreatRule'
          - $ref: '#/components/schemas/TimeFilter'
          items:
            $ref: '#/components/schemas/FilterRule'
          type: array
      required:
      - operator
      type: object
    RequestBody_Outliers:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/OutliersFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/OutliersProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    ThreatRule:
      properties:
        operator:
          description: Filter operator that is one of the example values and is run on the property field
          example: in
          type: string
        property:
          description: Filter property field that is one of the example values
          example: severity
          type: string
        values:
          description: Filter property value
          example: "Critical, High, Medium \n(used with severity in)"
          items:
            type: string
          type: array
      type: object
    RequestBody_ThreatSrc:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/ThreatSrcFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/ThreatSrcProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    OutliersProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: site_name, bandwidth_consumed, unit
          type: string
      type: object
    AppSrcProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, total_app_count, total_app_remote_network, total_app_mobile_users,total_app_proxy_nodes
          type: string
      type: object
    RequestBody_Threat:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/ThreatFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/ThreatProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    RequestBody_Resource:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/ResourceFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/ResourceProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    AppSrcRule:
      properties:
        rule:
          description: Rule name that is set to one of the example values
          example: app_risky
          type: string
      type: object
    ThreatSrcRule:
      properties:
        operator:
          description: Filter operator that is one of the example values and is run on the property field
          example: in
          type: string
        property:
          description: Filter property field that is one of the example values
          example: threat_severity
          type: string
        values:
          description: Filter property values
          example: "Critical, High, Medium \n(used with severity in)"
          items:
            type: string
          type: array
      type: object
    RequestBody_AppSrc:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/AppSrcFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/AppSrcProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    ThreatSummaryRule:
      properties:
        operator:
          description: Filter operator that is one of the example values and is run on the property field
          example: in
          type: string
        property:
          description: Filter property field that is one of the example values
          example: severity
          type: string
        values:
          description: Filter property values
          example: "Critical, High, Medium \n(used with severity in)"
          items:
            type: string
          type: array
      type: object
    OutliersFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/OutlierRule'
          - $ref: '#/components/schemas/TimeFilter'
          items:
            type: object
          type: array
      required:
      - operator
      type: object
    ThreatSrcProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, total_app_count, total_app_remote_network, total_app_mobile_users,total_app_proxy_nodes
          type: string
      type: object
    OutlierRule:
      properties:
        operator:
          description: Filter operator that is one of the example values and is run on the property field
          example: in
          type: string
        property:
          description: Filter property field that is one of the example values
          example: node_type
          type: string
        values:
          description: Filter property value
          example: 48, 49 if property is node_type
          items:
            type: string
          type: array
      type: object
    AlertProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, total_count, mu_count, rn_count, sc_count
          type: string
      type: object
    AppSummaryProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, total_app_count, total_app_remote_network, total_app_mobile_users,total_app_proxy_nodes
          type: string
      type: object
    RequestBody_ThreatSummary:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/ThreatSummaryFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/ThreatSummaryProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    UniqueUserProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: user_count
          type: string
      type: object
    RequestBody_UrlSummary:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/UrlSummaryFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/UrlSummaryProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    RequestBody_CDLStatus:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/CDLStatusFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/CDLStatusProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    IncidentRule:
      properties:
        operator:
          description: Filter operator that is one of the example values and is run on the property field
          example: in
          type: string
        property:
          description: Filter property field that is one of the example values
          example: status
          type: string
        values:
          description: Filter property value
          example: Raised, Cleared
          items:
            type: string
          type: array
      type: object
    ApplicationFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/ApplicationRule'
          - $ref: '#/components/schemas/TimeFilter'
          items:
            $ref: '#/components/schemas/FilterRule'
          type: array
      required:
      - operator
      type: object
    AppSummaryFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/AppSummaryRule'
          - $ref: '#/components/schemas/TimeFilter'
          items:
            type: object
          type: array
      required:
      - operator
      type: object
    RequestBody_Alert:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/AlertFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/AlertProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    UrlSummaryProperty:
      properties:
        alias:
          type: string
        function:
          description: Operations that need to be run on the property field. Operations can be run only on number properties.
          example: sum
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, uri_count
          type: string
        sort:
          $ref: '#/components/schemas/Sort'
      type: object
    UrlLogsRule:
      properties:
        operator:
          description: Filter operator that is one of the example values and is run on the property field
          example: in
          type: string
        property:
          description: Filter property field that is one of the example values
          example: url_category_value
          type: string
        values:
          description: Filter property values
          example: "high-risk, malware \n(used with url_category_value in)"
          items:
            type: string
          type: array
      type: object
    ApplicationProperty:
      properties:
        alias:
          type: string
        function:
          description: Operations that need to be run on the property field. Operations can be run only on number properties.
          example: count, sum, avg
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, app, unique_app_count, app_count
          type: string
        sort:
          $ref: '#/components/schemas/Sort'
      type: object
    IncidentFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/IncidentRule'
          - $ref: '#/components/schemas/TimeFilter'
          items:
            type: object
          type: array
      required:
      - operator
      type: object
    TimeFilter:
      properties:
        operator:
          description: Filter operator that is one of the example values and is run on the property field
          example: gt, lt, last_n_minutes, last_n_hours, last_n_days
          type: string
        property:
          description: Filter property field that is one of the example values
          example: event_time, update_time, updated_time
          type: string
        values:
          description: Filter property value
          example: minute, hour or day counts if property is event_time
          items:
            type: string
          type: array
      type: object
    Sort:
      properties:
        order:
          description: Sort Order for the property
          example: desc, asc
          type: string
      type: object
    ApplicationRule:
      properties:
        rule:
          description: Rule name that is set to one of the example values
          example: app_risky, blocked
          type: string
      type: object
    RequestBody_UniqueUsers:
      properties:
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/UniqueUserProperty'
          type: array
      required:
      - properties
      type: object
    RequestBody_AppSummary:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/AppSummaryFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/AppSummaryProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    CDLStatusRule:
      properties:
        operator:
          description: Filter operator that is one of the example values and is run on the property field
          example: in
          type: string
        property:
          description: Filter property field that is one of the example values
          example: status
          type: string
        values:
          description: Filter property value
          example: Up, Down if property is status
          items:
            type: string
          type: array
      type: object
    ThreatSrcFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/ThreatSrcRule'
          - $ref: '#/components/schemas/TimeFilter'
          items:
            $ref: '#/components/schemas/FilterRule'
          type: array
      required:
      - operator
      type: object
    ThreatSummaryProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, total_threats, blocked_count, unblocked_count,malicious_count
          type: string
      type: object
    UrlSummaryRule:
      properties:
        rule:
          description: Rule name that is set to one of the example values
          example: url_high_risk, blocked
          type: string
      type: object
    ResourceFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/TimeFilter'
          - $ref: '#/components/schemas/UrlLogsRule'
          items:
            type: object
          type: array
      required:
      - operator
      type: object
    ThreatSummaryFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/ThreatSummaryRule'
          - $ref: '#/components/schemas/TimeFilter'
          items:
            $ref: '#/components/schemas/FilterRule'
          type: array
      required:
      - operator
      type: object
    RequestBody_GatewayStatus:
      properties:
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/GatewayStatusProperty'
          type: array
      required:
      - properties
      type: object
    AppSrcFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/AppSrcRule'
          - $ref: '#/components/schemas/TimeFilter'
          items:
            type: object
          type: array
      required:
      - operator
      type: object
    CDLStatusProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, state, location_count
          type: string
      type: object
    IncidentProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, total_count, warning_count, critical_count, created_time, updated_time, category, status, raised_time, cleared_time
          type: string
      type: object
    UrlSummaryFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/UrlSummaryRule'
          - $ref: '#/components/schemas/TimeFilter'
          items:
            $ref: '#/components/schemas/FilterRule'
          type: array
      required:
      - operator
      type: object
    GatewayStatusProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: sub_tenant_id, status, gateway_count
          type: string
      type: object
    AppSummaryRule:
      properties:
        rule:
          description: Rule name that is set to one of the example values
          example: app_risky
          type: string
      type: object
    ResourceProperty:
      properties:
        alias:
          type: string
        property:
          description: Property field name. Property fields will be returned in the API response.
          example: severity,alert_id,node_type,node_count
          type: string
      type: object
    CDLStatusFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/CDLStatusRule'
          items:
            type: object
          type: array
      required:
      - operator
      type: object
    RequestBody_Application:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/ApplicationFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/ApplicationProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    FilterRule:
      type: object
    AlertRule:
      properties:
        operator:
          description: Filter operator that is one of the example values and is run on the property field
          example: in
          type: string
        property:
          description: Filter property field that is one of the example values
          example: domain
          type: string
        values:
          description: Filter property value
          example: External, external if property is domain
          items:
            type: string
          type: array
      type: object
    RequestBody_Incidents:
      properties:
        filter:
          allOf:
          - $ref: '#/components/schemas/IncidentFilter'
          - description: filter json object
        properties:
          description: List of property json objects
          items:
            $ref: '#/components/schemas/IncidentProperty'
          type: array
      required:
      - properties
      - filter
      type: object
    AlertFilter:
      properties:
        operator:
          description: Always set to AND
          type: string
        rules:
          anyOf:
          - $ref: '#/components/schemas/AlertRule'
          - $ref: '#/components/schemas/TimeFilter'
          items:
            type: object
          type: array
      required:
      - operator
      type: object
  securitySchemes:
    Bearer:
      scheme: bearer
      type: http