openapi: 3.0.1
info:
  title: Cisco Umbrella Reporting API
  description: |-
    The Reporting API provides the data to generate the Umbrella reports.
  version: 2.0.0
  contact:
    name: Cloud Security Developer Community
servers:
  - url: https://api.umbrella.com/{basePath}
    variables:
      basePath:
        default: reports/v2
tags:
  - name: Activity
  - name: Top Identities
  - name: Identity Distribution
  - name: Top Destinations
  - name: Top Categories
  - name: Top Event Types
  - name: Top DNS Query Types
  - name: Organization Requests by Hour
  - name: Organization Requests by Timerange
  - name: Organization Requests by Hour and Category
  - name: Organization Requests by Timerange and Category
  - name: Deployment Status
  - name: Provider Deployment Status
  - name: Provider Requests by Hour
  - name: Provider Requests by Timerange
  - name: Provider Requests by Organization
  - name: Provider Requests by Category
  - name: Provider Requests by Destination
  - name: Provider Category Requests by Organization
  - name: Bandwidth by Hour
  - name: Bandwidth by Timerange
  - name: Top Files
  - name: Total Requests
  - name: Top Threats
  - name: Top Threat Types
  - name: Utility
  - name: Top IPs
  - name: Summary
  - name: Summaries by Category
  - name: Summaries by Destination
  - name: Summaries by Rule (Intrusion)
  - name: Umbrella

security:
  - oauthFlow: []

paths:
  /activity:
    get:
      tags:
        - Activity
        - Umbrella
      summary: Get Activities (All)
      description: |-
        List all activities (dns/proxy/firewall/intrusion) within the timeframe.
        **Note:** The IP activity report is not available.

        **Access Scope:** Reports > Granular Events > Read-Only
      operationId: getActivities
      security:
        - oauthFlow:
          - reports.granularEvents:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/xTrafficTypeParam'
        - $ref: '#/components/parameters/isolatedStateParam'
        - $ref: '#/components/parameters/isolatedFileActionParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/httpErrorsParam'
        - $ref: '#/components/parameters/existsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      anyOf:
                        - $ref: '#/components/schemas/ActivityDns'
                        - $ref: '#/components/schemas/ActivityFirewall'
                        - $ref: '#/components/schemas/ActivityIntrusion'
                        - $ref: '#/components/schemas/ActivityProxy'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                meta: {}
                data:
                  - externalip: 52.8.160.247
                    internalip: 52.8.160.247
                    policycategories:
                    - id: 66
                      label: Malware
                      type: security
                      integration: true
                    categories:
                    - id: 66
                      label: Malware
                      type: security
                      integration: true
                    verdict: allowed
                    domain: google.com
                    timestamp: 1731002169000
                    time: '06:31:46'
                    date: '2019-01-24'
                    identities:
                    - id: 1
                      label: Catch Rate Testing System
                      type:
                        id: 21
                        label: Sites
                        type: site
                      deleted: true
                    threats:
                    - label: Wannacry
                      type: Ransomware
                    allapplications:
                      - id: 1
                        label: label
                        type: NBAR
                        category:
                          id: 1
                          label: category
                    allowedapplications:
                      - id: 1
                        label: label
                        type: NBAR
                        category:
                          id: 1
                          label: category
                    querytype: MX
                    returncode: 2
                    blockedapplications: []
                    type: dns
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /activity/dns:
    get:
      tags:
        - Activity
        - Umbrella
      summary: Get Activity DNS
      description: |-
        List all DNS entries within the timeframe.

        **Access Scope:** Reports > Granular Events > Read-Only
      operationId: getActivityDns
      security:
        - oauthFlow:
          - reports.granularEvents:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/orderParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityDns'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - externalip: 52.8.160.247
                  internalip: 52.8.160.247
                  policycategories:
                    - id: 66
                      label: Malware
                      type: security
                      integration: true
                  categories:
                    - id: 66
                      label: Malware
                      type: security
                      integration: true
                  verdict: allowed
                  domain: google.com
                  timestamp: 1731002169000
                  time: '06:31:46'
                  date: '2019-01-24'
                  identities:
                    - id: 1
                      label: Catch Rate Testing System
                      type:
                        id: 21
                        label: Sites
                        type: site
                      deleted: true
                  threats:
                    - label: Wannacry
                      type: Ransomware
                  allapplications:
                    - id: 1
                      label: label
                      type: NBAR
                      category:
                        id: 1
                        label: category
                  allowedapplications:
                    - id: 1
                      label: label
                      type: NBAR
                      category:
                        id: 1
                        label: category
                  querytype: MX
                  returncode: 2
                  blockedapplications: []
                  type: dns
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /activity/proxy:
    get:
      tags:
        - Activity
        - Umbrella
      summary: Get Activity Proxy
      description: |-
        List all proxy entries within the timeframe.

        **Access Scope:** Reports > Granular Events > Read-Only
      operationId: getActivityProxy
      security:
        - oauthFlow:
          - reports.granularEvents:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/orderParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/tenantControlsParam'
        - $ref: '#/components/parameters/isolatedStateParam'
        - $ref: '#/components/parameters/isolatedFileActionParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/httpErrorsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityProxy'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - destinationip: ''
                    externalip: 32.4.91.7
                    responsesize: 3329530
                    allapplications:
                     - id: 1313
                       label: Netflix
                       category:
                         id: 47
                         label: Media
                    date: '2022-02-18'
                    datalossprevention:
                      state: ''
                    antivirusthreats:
                      puas: []
                      viruses: []
                      others: []
                    internalip: 192.168.1.43
                    referer: ''
                    contenttype: ''
                    tenantcontrols: false
                    securityoverridden: false
                    useragent: ''
                    time: '23:29:42'
                    amp:
                      disposition: ''
                      score: 0
                      malware: ''
                    policycategories: []
                    type: proxy
                    requestsize: 1996
                    port: 443
                    policy:
                      ruleid: 0
                      rulesetid: 0
                      destinationlistids: []
                      timebasedrule: false
                    forwardingmethod: ''
                    categories:
                      - id: 17
                        type: content
                        label: Movies
                        integration: false
                        deprecated: true
                    isolated:
                      state: not-isolated
                      fileaction: ''
                    statuscode: 200
                    egress:
                      ip: 155.190.3.8
                      type: shared
                    blockedfiletype: ''
                    url: https://ipv4-lax2-ix.1.oca.anothervideo.net
                    verdict: allowed
                    responsefilename: ''
                    warnstatus: ''
                    sha256: ''
                    timestamp: 1645226982000
                    blockedapplications: []
                    allowedapplications: []
                    identities:
                      - id: 1
                        type:
                          id: 34
                          type: anyconnect
                          label: Anyconnect Roaming Client
                        label: Vincent's Macbook
                        deleted: false
                    datacenter:
                      label: Los Angeles, US
                      id: LAX
                    threats: []
                    httperrors: []
                    bundleid: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /activity/firewall:
    get:
      tags:
        - Activity
        - Umbrella
      summary: Get Activity Firewall
      description: |-
        List all firewall activity within the timeframe.

        **Access Scope:** Reports > Granular Events > Read-Only
      operationId: getActivityFirewall
      security:
        - oauthFlow:
          - reports.granularEvents:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/timezoneParam'
        - $ref: '#/components/parameters/categoriesParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityFirewall'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                  - date: "2019"
                    destinationip: 52.8.160.247
                    sourceip: 192.168.0.1
                    sourceport: 0
                    destinationport: 0
                    categories:
                    - id: 66
                      label: Malware
                      type: security
                      integration: true
                    verdict: allowed
                    time: '12:34'
                    timestamp: 1731002169000
                    identities:
                      - id: 1
                        label: Catch Rate Testing System
                        type:
                          id: 21
                          label: Sites
                          type: site
                        deleted: false
                    protocol:
                      id: 17
                      label: UDP
                    rule:
                      id: 1
                      label: Default Rule
                    type: firewall
                    allapplications:
                      - id: 72
                        label: 'dns IT Service Management'
                        app: ""
                    applicationprotocols:
                      - id: 72
                        label: 'dns IT Service Management'
                        app: ""
                    packetsize: 32
                    direction: towards
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /activity/intrusion:
    get:
      tags:
        - Activity
        - Umbrella
      summary: Get Activity Intrusion
      description: |-
        List all Intrusion Prevention System (IPS) activity within the timeframe.

        **Access Scope:** Reports > Granular Events > Read-Only
      operationId: getActivityIntrusion
      security:
        - oauthFlow:
          - reports.granularEvents:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/signaturesParam'
        - $ref: '#/components/parameters/signatureListIdsParam'
        - $ref: '#/components/parameters/intrusionActionParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityIntrusion'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - type: intrusion
                    date: "12-02-22"
                    destinationip: "10.10.10.10"
                    protocol:
                      id: 17
                      label: UDP
                    sourceip: "10.10.10.10"
                    signaturelist:
                      id: 1111
                    classification: malicious
                    rule:
                      - id: 391327
                        label: "UNKNOWN"
                    ipsProfile: "PROFILE"
                    sourceport: 22
                    sessionid: 190898098
                    verdict: detected
                    destinationport: 33
                    timestamp: 1594557262000
                    time: '09:30'
                    identities:
                      - id: 211034846
                        type:
                          id: 34
                          type: anyconnect
                          label: Anyconnect Roaming Client
                        label: omerta
                        deleted: false
                    severity: HIGH
                    signature:
                      generatorid: 1
                      id: 47829
                      label: "SERVER-OTHER JBoss Richfaces expression language injection attempt"
                      cves:
                        - "cve-2015-0279"
                        - "cve-2018-12532"
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  # deprecated IP Enforcement Layer
  /activity/ip:
    get:
      tags:
        - Activity
        - Umbrella
      summary: Get Activity IP
      description: |-
        (Deprecated) List all IP activity within the timeframe.

        **Access Scope:** Reports > Granular Events > Read-Only
      operationId: getActivityIP
      security:
        - oauthFlow:
          - reports.granularEvents:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items: {}
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data: []
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /activity/amp-retrospective:
    get:
      tags:
        - Activity
        - Umbrella
      summary: Get Activity AMP Retrospective
      description: |-
        List all AMP retrospective activity within the timeframe.

        **Access Scope:** Reports > Granular Events > Read-Only
      operationId: getActivityAmpRetrospective
      security:
        - oauthFlow:
          - reports.granularEvents:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityAMPRetro'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - timestamp: 1548311506
                  firstseenat: 1548311506
                  disposition: clean
                  score: 10
                  hostname: google.com
                  malwarename: malware
                  sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-identities:
    get:
      tags:
        - Top Identities
        - Umbrella
      summary: Get Top Identities (All)
      description: |-
        List the identities by the number of requests made, sorted in descending order.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopIdentities
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIdentity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - requests: 3827
                  bandwidth: 7051943359
                  identity:
                    id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  rank: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-identities/{type}:
    get:
      tags:
        - Top Identities
        - Umbrella
      summary: Get Top Identities
      description: |-
        List the identities for the specific traffic type by the number of requests.
        Sort the results in descending order.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopIdentitiesType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIdentity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - requests: 3827
                  bandwidth: 7051943359
                  identity:
                    id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  rank: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /identity-distribution:
    get:
      tags:
        - Identity Distribution
        - Umbrella
      summary: Get Identity Distribution (All)
      description: |-
        List the number of requests by identity types.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getIdentityDistribution
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/IdentityDistribution'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  requests: 312
                  unique_identity_count: 12
                  identitytype:
                    id: 21
                    label: Sites
                    type: site
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /identity-distribution/{type}:
    get:
      tags:
        - Identity Distribution
        - Umbrella
      summary: Get Identity Distribution By Type
      description: |-
        List the number of requests by identity for the type of traffic.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getIdentityDistributionType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: The list of identity distributions.
                    items:
                      $ref: '#/components/schemas/IdentityDistribution'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  requests: 312
                  unique_identity_count: 12
                  identitytype:
                    id: 21
                    label: Sites
                    type: site
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-destinations:
    get:
      tags:
        - Top Destinations
        - Umbrella
      summary: Get Top Destinations
      description: |-
        List the destinations by the number of requests made to this destination.
        Return the results in descending order.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopDestinations
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetRequiredParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - bandwidth: 223437
                    rank: 4
                    domain: google.com
                    count: 3827
                    counts:
                      requests: 123
                      allowedrequests: 60
                      blockedrequests: 63
                    categories:
                      - id: 66
                        label: Malware
                        type: security
                        integration: true
                    policycategories:
                      - id: 66
                        label: Malware
                        type: security
                        integration: true
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-destinations/{type}:
    get:
      tags:
        - Top Destinations
        - Umbrella
      summary: Get Top Destinations By Type
      description: |-
        List the destinations by type of destination and the number of requests made
        to this destination. Return the collection in descending order.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopDestinationsType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - bandwidth: 223437
                  rank: 4
                  domain: google.com
                  count: 3827
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  categories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  policycategories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-urls:
    get:
      tags:
        - Top Destinations
        - Umbrella
      summary: Get Top URLs
      description: |-
        List the top number of URLs that are requested for a certain domain.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopUrls
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetRequiredParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopURL'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - count: 884
                    path: '/backend-api/conversation'
                    categories:
                      - id: 132
                        type: content
                        label: SaaS and B2B
                        integration: false
                        deprecated: false
                    rank: 1
                  - count: 123
                    path: ""
                    categories:
                      - id: 66
                        label: Malware
                        type: security
                        integration: true
                    rank: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-categories:
    get:
      tags:
        - Top Categories
        - Umbrella
      summary: Get Top Categories (All)
      description: |-
        List the categories that received the greatest number of requests.
        Order the number of requests in descending order.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopCategories
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetRequiredParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - rank: 5
                  category:
                    id: 66
                    label: Malware
                    typse: security
                    integration: true
                  count: 3827
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-categories/{type}:
    get:
      tags:
        - Top Categories
        - Umbrella
      summary: Get Top Categories By Type
      description: |-
        List the categories for the type of traffic that received the greatest number of requests.
        Order the number of requests in descending order.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopCategoriesType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetRequiredParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - rank: 5
                  category:
                    id: 66
                    label: Malware
                    type: security
                    integration: true
                  count: 3827
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-eventtypes:
    get:
      tags:
        - Top Event Types
        - Umbrella
      summary: Get Top Event Types (All)
      description: |-
        List the top event types by the number of requests made for each type of event.
        Order the number of requests in descending order.
        The valid event types are: `domain_security`, `domain_integration`,
        `url_security`, `url_integration`, `cisco_amp`, and `antivirus`.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopEventTypes
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopEventType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - eventtype: antivirus
                  count: 3827
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-dns-query-types:
    get:
      tags:
        - Top DNS Query Types
        - Umbrella
      summary: Get Top DNS Query Types
      operationId: getTopDNSQueryTypes
      description: |-
        List the top types of DNS query.

        **Access Scope:** Reports > Aggregations > Read-Only
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/orderParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopDnsQueryType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - requests: 123
                  querytype: A
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /requests-by-hour:
    get:
      tags:
        - Organization Requests by Hour
        - Umbrella
      summary: Get Requests by Hour (All)
      description: |-
        List the activity volume within the timeframe.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getRequestsByHour
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /requests-by-hour/{type}:
    get:
      tags:
        - Organization Requests by Hour
        - Umbrella
      summary: Get Requests by Hour
      description: |-
        List the activity volume within the timeframe.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getOrganizationRequestsByHour
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeAllParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /requests-by-timerange:
    get:
      tags:
        - Organization Requests by Timerange
        - Umbrella
      summary: Get Requests by Timerange (All)
      description: |-
        List the activity volume within the timeframe.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getRequestsByTimerange
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/xTrafficTypeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: The information about the provider's requests within the timerange.
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /requests-by-timerange/{type}:
    get:
      tags:
        - Organization Requests by Timerange
        - Umbrella
      summary: Get Requests by Timerange
      description: |-
        List the activity volume within the timeframe.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getRequestsByTimerangeType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeAllParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /categories-by-hour:
    get:
      tags:
        - Organization Requests by Hour and Category
        - Umbrella
      summary: Get Requests by Hour and Category (All)
      description: |-
        List the activity volume within the timeframe by type of category.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getRequestsByHourAndCategory
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                  counts:
                    - category:
                        id: 66
                        label: Malware
                        type: security
                        integration: true
                      requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /categories-by-hour/{type}:
    get:
      tags:
        - Organization Requests by Hour and Category
        - Umbrella
      summary: Get Requests by Hour and Category
      description: |-
        List the activity volume for the type of category within the timeframe.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getRequestsByHourAndCategoryAndType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                  counts:
                    - category:
                        id: 66
                        label: Malware
                        type: security
                        integration: true
                      requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /categories-by-timerange:
    get:
      tags:
        - Organization Requests by Timerange and Category
        - Umbrella
      summary: Get Requests by Timerange and Category (All)
      description: |-
        List the activity volume within the timeframe by category.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getRequestsByTimerangeAndCategory
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                  counts:
                    - category:
                        id: 66
                        label: Malware
                        type: security
                        integration: true
                      requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /categories-by-timerange/{type}:
    get:
      tags:
        - Organization Requests by Timerange and Category
        - Umbrella
      summary: Get Requests by Timerange and Category
      description: |-
        List the activity volume within the timeframe by category.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getRequestsByTimerangeAndCategoryType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                  counts:
                    - category:
                        id: 66
                        label: Malware
                        type: security
                        integration: true
                      requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /deployment-status:
    get:
      tags:
        - Deployment Status
        - Umbrella
      summary: Get Deployment Status
      description: |-
        List the deployment status within the timeframe.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getDeploymentStatus
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/DeploymentStatus'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - id: 21
                  label: Sites
                  type:
                    id: 1
                    label: Sites
                    type: Sites
                  activecount: 1
                  count: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /bandwidth-by-hour:
    get:
      tags:
        - Bandwidth by Hour
        - Umbrella
      summary: Get Bandwidth by Hour (All)
      description: |-
        List the bandwidth in bytes within the timeframe. Only returns proxy data.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getBandwidthByHour
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/BandwidthbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - inboundbytes: 123
                    outboundbytes: 456
                    timestamp: 1559836800000
                    date: '2019'
                    time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /bandwidth-by-timerange:
    get:
      tags:
        - Bandwidth by Timerange
        - Umbrella
      summary: Get Bandwidth by Timerange (All)
      description: |-
        List the bandwidth in bytes within the timeframe. Only returns proxy data.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getBandwidthByTimerange
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/BandwidthbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - inboundbytes: 123
                    outboundbytes: 456
                    timestamp: 1559836800000
                    date: '2019'
                    time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-files:
    get:
      tags:
        - Top Files
        - Umbrella
      summary: Get Top Files (Proxy)
      description: |-
        List the top files within the timeframe. Only returns proxy data.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopFilesProxy
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopFile'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - requests: 123
                  sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
                  categories:
                    - id: 66
                      label: Malware
                      type: security
                      integration: true
                  identitycount: 1
                  filenames: []
                  filetypes: []
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /total-requests:
    get:
      tags:
        - Total Requests
        - Umbrella
      summary: Get Total Requests (All)
      description: |-
        Get the count of the total requests.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTotalRequests
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/TotalRequest'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /total-requests/{type}:
    get:
      tags:
        - Total Requests
        - Umbrella
      summary: Get Total Requests (By Type)
      description: |-
        Get the count of the total requests for the request type.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTotalRequestsByType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/TotalRequest'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-threats:
    get:
      tags:
        - Top Threats
        - Umbrella
      summary: Get Top Threats (All)
      description: |-
        Get the top threats within the timeframe. Returns both DNS and proxy data.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopThreats
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreats'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - threat: Wannacry
                  threattype: Ransomware
                  count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-threats/{type}:
    get:
      tags:
        - Top Threats
        - Umbrella
      summary: Get Top Threats (By Type)
      description: |-
        Get the top threats within the timeframe.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopThreatsByType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreats'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - threat: Wannacry
                  threattype: Ransomware
                  count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-threat-types:
    get:
      tags:
        - Top Threat Types
        - Umbrella
      summary: Get Top Threat Types (All)
      description: |-
        List the top types of threat within the timeframe. Returns both DNS and proxy data.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopThreatTypes
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreatTypes'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - threattype: Ransomware
                    threatscount: 10
                    count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-threat-types/{type}:
    get:
      tags:
        - Top Threat Types
        - Umbrella
      summary: Get Top Threat Types By Type
      description: |-
        List the top threat-types within the timeframe.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopThreatTypesByType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreatTypes'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - threattype: Ransomware
                    threatscount: 10
                    count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /applications:
    get:
      tags:
        - Utility
        - Umbrella
      summary: Get Applications
      operationId: getApplications
      description: |-
        List the applications.

        **Access Scope:** Reports > Utilities > Read-Only
      security:
        - oauthFlow:
          - reports.utilities:read
      parameters:
        - $ref: '#/components/parameters/applicationNameParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ApplicationsWithCategories'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  applications:
                    - id: 1
                      label: "Web Hosting"
                      type: "AVC"
                      category:
                        id: 40
                        label: "Hosting Services"
                  categories:
                    - id: 42
                      name: "Education"
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /categories:
    get:
      tags:
        - Utility
        - Umbrella
      summary: Get Categories
      description: |-
        List the categories.

        **Access Scope:** Reports > Utilities > Read-Only
      operationId: getCategories
      security:
        - oauthFlow:
          - reports.utilities:read
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryWithLegacyId'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - id: 66
                    legacyid: 94
                    label: Malware
                    type: security
                    integration: true
                    deprecated: true
                  - id: 110
                    legacyid: 176
                    label: DNS Tunneling VPN
                    type: security
                    integration: true
                    deprecated: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /identities:
    get:
      tags:
        - Utility
        - Umbrella
      summary: Get Identities
      operationId: getIdentities
      description: |-
        List the identities.

        **Access Scope:** Reports > Utilities > Read-Only
      security:
        - oauthFlow:
          - reports.utilities:read
      parameters:
        - $ref: '#/components/parameters/limitParamIdentitiesUtility'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/searchParam'
        - $ref: '#/components/parameters/identityTypesParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Identity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
    post:
      tags:
        - Utility
        - Umbrella
      summary: Get Identities By IDs
      description: |-
        Get the identities information by providing a list of identity IDs in the request body.

        **Access Scope:** Reports > Utilities > Read-Only
      operationId: postIdentities
      security:
        - oauthFlow:
          - reports.utilities:read
      parameters:
        - $ref: '#/components/parameters/limitParam'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              description: Provide an array of identity ID.
              properties:
                identityids:
                  description: A list of identity ID.
                  type: array
                  items:
                    type: integer
                    description: An identity ID.
                    example: 234567891
            example:
              identityids: [234567891, 234567892]
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Identity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /identities/{identityid}:
    get:
      tags:
        - Utility
        - Umbrella
      summary: Get Identity
      description: |-
        Get identity by identity ID.

        **Access Scope:** Reports > Utilities > Read-Only
      operationId: getIdentity
      security:
        - oauthFlow:
          - reports.utilities:read
      parameters:
        - $ref: '#/components/parameters/identityIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Identity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  id: 1
                  label: Catch Rate Testing System
                  type:
                    id: 21
                    label: Sites
                    type: site
                  deleted: true
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /threat-types:
    get:
      tags:
        - Utility
        - Umbrella
      summary: Get Threat Types
      description: |-
        List the threat types.

        **Access Scope:** Reports > Utilities > Read-Only
      operationId: getThreatTypes
      security:
        - oauthFlow:
          - reports.utilities:read
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ThreatType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - name: Ransomware
                  description: a description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /threat-types/{threattypeid}:
    get:
      tags:
        - Utility
        - Umbrella
      summary: Get Threat Type By Threat ID
      description: |-
        List the threat types by threat ID.

        **Access Scope:** Reports > Utilities > Read-Only
      operationId: getThreatType
      security:
        - oauthFlow:
          - reports.utilities:read
      parameters:
        - $ref: '#/components/parameters/threatTypeIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ThreatType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                    name: Ransomware
                    description: a description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /threat-names:
    get:
      tags:
        - Utility
        - Umbrella
      summary: Get Threat Names
      description: |-
        List the threat names.

        **Access Scope:** Reports > Utilities > Read-Only
      operationId: getThreatNames
      security:
        - oauthFlow:
          - reports.utilities:read
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ThreatName'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - name: WannaCry
                  description: a description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /threat-names/{threatnameid}:
    get:
      tags:
        - Utility
        - Umbrella
      summary: Get Threat Name By Threat ID
      description: |-
        Get the threat name by threat ID.

        **Access Scope:** Reports > Utilities > Read-Only
      operationId: getThreatName
      security:
        - oauthFlow:
          - reports.utilities:read
      parameters:
        - $ref: '#/components/parameters/threatNameIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ThreatName'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  name: WannaCry
                  description: WannaCry threat description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-ips:
    get:
      tags:
        - Top IPs
        - Umbrella
      summary: Get Top IPs
      description: |-
        List the top IP addresses.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopIps
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIP'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                 - ip: 10.0.0.1
                   count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /top-ips/internal:
    get:
      tags:
        - Top IPs
        - Umbrella
      summary: Get Top IPs Internal
      description: |-
        List the top internal IP addresses.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getTopIpsInternal
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items: 
                      $ref: '#/components/schemas/TopIP'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - ip: 10.0.0.1
                  count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /summary:
    get:
      tags:
        - Summary
        - Umbrella
      summary: Get Summary (All)
      description: |-
        Get the summary report.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getSummary
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Summary'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  applications: 123
                  domains: 82
                  requestsblocked: 189
                  filetypes: 0
                  policycategories: 2
                  policyrequests: 2
                  requests: 189
                  requestsallowed: 10
                  categories: 11
                  identitytypes: 1
                  applicationsblocked: 2
                  files: 5
                  identities: 1
                  applicationsallowed: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /summary/{type}:
    get:
      tags:
        - Summary
        - Umbrella
      summary: Get Summary By Type
      description: |-
        Get the summary of requests by the traffic type.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getSummaryByType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Summary'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  applications: 123
                  domains: 82
                  requestsblocked: 189
                  filetypes: 0
                  policycategories: 2
                  requests: 189
                  requestsallowed: 10
                  categories: 11
                  identitytypes: 1
                  applicationsblocked: 2
                  files: 5
                  identities: 1
                  applicationsallowed: 2
                  policyrequests: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /summaries-by-category:
    get:
      tags:
        - Summaries by Category
        - Umbrella
      summary: Get Summaries by Category (All)
      description: |-
        List the summaries of requests by category.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getSummariesByCategory
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    summary:
                      applications: 123
                      domains: 82
                      requestsblocked: 189
                      filetypes: 0
                      policycategories: 2
                      requests: 189
                      requestsallowed: 10
                      categories: 11
                      identitytypes: 1
                      applicationsblocked: 2
                      files: 5
                      identities: 1
                      applicationsallowed: 2
                      policyrequests: 6
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /summaries-by-category/{type}:
    get:
      tags:
        - Summaries by Category
        - Umbrella
      summary: Get Summaries by Category For Type
      description: |-
        List the summaries by category for the type of request.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getSummariesByCategoryType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    summary:
                      applications: 123
                      domains: 82
                      requestsblocked: 189
                      filetypes: 0
                      policycategories: 2
                      requests: 189
                      requestsallowed: 10
                      categories: 11
                      identitytypes: 1
                      applicationsblocked: 2
                      files: 5
                      identities: 1
                      applicationsallowed: 2
                      policyrequests: 4
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /summaries-by-destination:
    get:
      tags:
        - Summaries by Destination
        - Umbrella
      summary: Get Summaries by Destination (All)
      description: |-
        List the summaries by destination.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getSummariesByDestination
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - domain: www.google.com
                    summary:
                      applications: 123
                      domains: 82
                      requestsblocked: 189
                      filetypes: 0
                      policycategories: 2
                      policyrequests: 2
                      requests: 189
                      requestsallowed: 10
                      categories: 11
                      identitytypes: 1
                      applicationsblocked: 2
                      files: 5
                      identities: 1
                      applicationsallowed: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /summaries-by-destination/{type}:
    get:
      tags:
        - Summaries by Destination
        - Umbrella
      summary: Get Summaries by Destination For Type
      description: |-
        List the summaries by destination for the type of traffic.

        **Access Scope:** Reports > Aggregations > Read-Only
      operationId: getSummariesByDestinationType
      security:
        - oauthFlow:
          - reports.aggregations:read
      parameters:
        - $ref: '#/components/parameters/typeDnsWebParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - domain: www.google.com
                    summary:
                      applications: 123
                      domains: 82
                      requestsblocked: 189
                      filetypes: 0
                      policycategories: 2
                      policyrequests: 2
                      requests: 189
                      requestsallowed: 10
                      categories: 11
                      identitytypes: 1
                      applicationsblocked: 2
                      files: 5
                      identities: 1
                      applicationsallowed: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /summaries-by-rule/intrusion:
    get:
      tags:
        - Summaries by Rule (Intrusion)
        - Umbrella
      summary: Get Summaries by Rule
      description: |-
        List the summaries by rule for the intrusion type.

        **Access Scope:** Reports > Summaries by rule > Read-Only
      operationId: getSummariesByRuleIntrusion
      security:
        - oauthFlow:
          - reports.summariesByRule:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/signaturesParam'
        - $ref: '#/components/parameters/signatureListIdsParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/intrusionActionParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SignatureListSummary'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - signaturelist:
                      id: 1111
                    signatures:
                      - counts:
                          blocked: 0
                          detected: 1
                          wouldblock: 0
                        generatorid: 1
                        lasteventat: 1594557262000
                        id: 47829
                    rule:
                      id: 47
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/categories:
    get:
      tags:
        - Utility
        - Umbrella
      summary: Get Provider Categories
      description: |-
        List the Provider categories

        **Access Scope:** Reports > Customer > Read-Only
      operationId: getProviderCategories
      security:
        - oauthFlow:
          - reports.utilities:read
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryWithLegacyId'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - id: 66
                    legacyid: 94
                    label: Malware
                    type: security
                    integration: true
                    deprecated: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/deployments:
    get:
      tags:
        - Provider Deployment Status
        - Umbrella
      summary: Get Deployment Status by Organization
      description: |-
        List the summary counts of deployment status for the organization within the timeframe.

        **Access Scope:** Reports > Customer > Read-Only
      operationId: getDeploymentStatusByOrganization
      security:
        - oauthFlow:
          - reports.customers:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/OrganizationDeploymentStatus'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - organization:
                    id: 232323
                    label: Company Name Goes Here
                  counts:
                    - identitytype:
                        id: 21
                        label: Sites
                        type: site
                      activecount: 1
                      count: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/requests-by-hour:
    get:
      tags:
        - Provider Requests by Hour
        - Umbrella
      summary: Get Provider Requests by Hour (All)
      description: |-
        List the activity volume within the timeframe.

        **Access Scope:** Reports > Customer > Read-Only
      operationId: getProviderRequestsByHour
      security:
        - oauthFlow:
          - reports.customers:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: The information about the provider's requests within the timerange.
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/requests-by-timerange:
    get:
      tags:
        - Provider Requests by Timerange
        - Umbrella
      summary: Get Provider Requests by Timerange (All)
      description: |-
        List the activity volume within the timeframe.

        **Access Scope:** Reports > Customer > Read-Only
      operationId: getProviderRequestsByTimerange
      security:
        - oauthFlow:
          - reports.customers:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: The information about the provider's requests within the timerange.
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/requests-by-org:
    get:
      tags:
        - Provider Requests by Organization
        - Umbrella
      summary: Get Provider Requests by Organization
      description: |-
        List the summary counts of all requests within the timeframe.

        **Access Scope:** Reports > Customer > Read-Only
      operationId: getProviderRequestsByOrganization
      security:
        - oauthFlow:
          - reports.customers:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyOrganization'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - organization:
                      id: 232323
                      label: Company Name Goes Here
                    counts:
                      total: 1
                      totalblocked: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/requests-by-category:
    get:
      tags:
        - Provider Requests by Category
        - Umbrella
      summary: Get Provider Requests by Category
      description: |-
        List the summary counts of all requests within the timeframe.

        **Access Scope:** Reports > Customer > Read-Only
      operationId: getProviderRequestsByCategory
      security:
        - oauthFlow:
          - reports.customers:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    counts:
                      total: 1
                      totalblocked: 1
                      numberoforganizationsaffected: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/requests-by-destination:
    get:
      tags:
        - Provider Requests by Destination
        - Umbrella
      summary: Get Provider Requests by Destination
      description: |-
        List the summary counts of all requests within the timeframe.

        **Access Scope:** Reports > Customer > Read-Only
      operationId: getProviderRequestsByDestination
      security:
        - oauthFlow:
          - reports.customers:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ProviderRequestsbyDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - domain: ""
                    categories:
                      - id: 66
                        label: Malware
                        type: security
                        integration: true
                    counts:
                      total: 1
                      totalblocked: 1
                      numberoforganizationsaffected: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/category-requests-by-org:
    get:
      tags:
        - Provider Category Requests by Organization
        - Umbrella
      summary: Get Provider Category Requests by Organization
      description: |-
        List the summary counts of all requests for each category within the timeframe.

        **Access Scope:** Reports > Customer > Read-Only
      operationId: getProviderCategoryRequestsByOrganization
      security:
        - oauthFlow:
          - reports.customers:read
      parameters:
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ProviderCategoryRequestsByOrganization'  
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - organization:
                      id: 232323
                      label: Company Name Goes Here
                    counts:
                      - category:
                          id: 66
                          label: Malware
                          type: security
                          integration: true
                        requests: 123
                        requestsblocked: 34
                        numberoforganizationswithcategorizedtraffic: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

#  /cloud-malware:
#    get:
#      tags:
#        - Cloud Malware
#      summary: Get Cloud Malware Events
#      description: List the events logged by Cloud Malware.
#      operationId: getCloudMalwareEvents
#      security:
#        - oauthFlow:
#          - reports.aggregations:read
#      parameters:
#        - $ref: '#/components/parameters/fromParam'
#        - $ref: '#/components/parameters/toParam'
#        - $ref: '#/components/parameters/limitParam'
#        - $ref: '#/components/parameters/timezoneParam'
#      responses:
#        '200':
#          description: OK
#          content:
#            application/json:
#              schema:
#               type: object
#                properties:
#                  data:
#                    type: array
#                    items:
#                      $ref: '#/components/schemas/CloudMalware'
#                  meta:
#                    $ref: '#/components/schemas/Meta'
#                required:
#                  - data
#                  - meta
#              example:
#                data: []
#                meta: {}
#        '400':
#          $ref: '#/components/responses/400Error'
#        '401':
#          $ref: '#/components/responses/401Error'
#        '403':
#          $ref: '#/components/responses/403Error'
#        '404':
#          $ref: '#/components/responses/404Error'
#        '500':
#          $ref: '#/components/responses/500Error'

components:

  parameters:

    fromParam:
      name: from
      in: query
      description: |-
        A timestamp or relative time string (for example: '-1days').
        Filter for data that appears after this time.
      required: true
      schema:
        type: string
      example: '1639146300000'

    toParam:
      name: to
      in: query
      description: |-
        A timestamp or relative time string (for example: 'now').
        Filter for data that appears before this time.
      required: true
      schema:
        type: string
      example: '1640010300000'

    offsetParam:
      name: offset
      in: query
      description:
        A number that represents an index in the collection.
      schema:
        type: number
        default: 0
      example: 0

    offsetRequiredParam:
      name: offset
      in: query
      description:
        A number that represents an index in the collection.
      required: true
      schema:
        type: number
      example: 0

    limitParam:
      name: limit
      in: query
      description:
        The maximum number of records to return from the collection.
      required: true
      schema:
        type: number
        default: 100
      example: 100

    # identities Utility endpoint
    limitParamIdentitiesUtility:
      name: limit
      in: query
      description: |-
        (Identities utility endpoint) The number of records to return from the collection.
        The default limit is 100. In a single response, the server returns at most 5000 records from the collection.
      required: true
      schema:
        type: number
        default: 100
      example: 100

    timezoneParam:
      name: timezone
      in: query
      description: |-
        Display the timestamp of the traffic events in the specified timezone.
        For the timezone, provide a continent and city separated by an url-encoded forward slash ('/'), for example: timezone='ASIA%2fCALCUTTA'.
      schema:
        type: string
      example: 'ASIA%2fCALCUTTA'

    domainsParam:
      name: domains
      in: query
      description:
        A domain name or comma-delimited list of domain name.
      schema:
        type: string
      example: 'cisco.com,nasa.gov'

    urlsParam:
      name: urls
      in: query
      description: A URL or comma-delimited list of URL.
      schema:
        type: string
      example: 'https://google.com,facebook.com/help'

    categoriesParam:
      name: categories
      in: query
      description: A category ID or comma-delimited list of category ID.
      schema:
        type: string
      example: '148,151,66'

    policyCategoriesParam:
      name: policycategories
      in: query
      description: |-
        A category ID or comma-delimited list of category ID.
        Filter the request by the categories that trigger a policy.
      schema:
        type: string
      example: '67,69'

    ipParam:
      name: ip
      in: query
      description: An IP address.
      schema:
        type: string
      example: '10.10.10.10'

    orderParam:
      name: order
      in: query
      description: |-
        A string that describes how to order the results: ascending (`asc`) or descending (`desc`).
      schema:
        type: string
        enum:
          - asc
          - desc
      example: desc

    portsParam:
      name: ports
      in: query
      description: A port number or comma-delimited list of port numbers.
      schema:
        type: string
      example: '7351,80'

    identityIdsParam:
      name: identityids
      in: query
      description: An identity ID or comma-delimited list of identity IDs.
      schema:
        type: string
      example: '1,2,3'

    identityTypesParam:
      name: identitytypes
      in: query
      description: An identity type or comma-delimited list of identity types.
      schema:
        type: string
      example: network,roaming

    applicationIdParam:
      name: applicationid
      in: query
      description: The ID of the application.
      schema:
        type: string
      example: '1'

    verdictParam:
      name: verdict
      in: query
      description: |-
        A string or comma-delimited string that describes whether the traffic can reach the destination.
      schema:
        type: string
      example: allowed,blocked,proxied

    ruleIdParam:
      name: ruleid
      in: query
      description: The firewall policy rule ID.
      schema:
        type: number
      example: 1
    filenameParam:
      name: filename
      in: query
      description: |-
        A string that identifies a filename. Filter the request by the filename.
        Supports globbing or use of the wildcard character ('*'). The asterisk (*) matches
        zero or more occurrences of any character.
      schema:
        type: string
      example: 'myfilename_*'

    securityOverriddenParam:
      name: securityoverridden
      in: query
      description: Specify whether to filter on requests that override security.
      schema:
        type: boolean
      example: true

    bundleIdParam:
      name: bundleid
      in: query
      description: A proxy bundle ID.
      schema:
        type: number
      example: 1

    threatsParam:
      name: threats
      in: query
      description: A threat name or comma-delimited list of threat names.
      schema:
        type: string

    threatTypesParam:
      name: threattypes
      in: query
      description: A threat type or comma-delimited list of threat types.
      schema:
        type: string

    ampDispositionParam:
      name: ampdisposition
      in: query
      description: |-
        An AMP disposition string or a comma-delimited list of AMP disposition strings.
      schema:
        type: string
      example: clean,malicious,unknown

    isolatedStateParam:
      name: isolatedstate
      in: query
      description: |-
        A string that describes the remote browser isolation (RBI) isolation type.
      schema:
        type: string
        enum: [isolated, not-isolated]
      example: isolated

    isolatedFileActionParam:
      name: isolatedFileAction
      in: query
      description: |-
        A string that describes the remote browser isolation (RBI) file action type.
      schema:
        type: string
        enum: [viewed, downloaded-original-file, downloaded-safe-pdf]
      example: downloaded-safe-pdf

    dataLossPreventionStateParam:
      name: datalosspreventionstate
      in: query
      description: |-
        A string that describes the status of a destination.
        Filter for requests that are blocked by the DLP layer security.
      schema:
        type: string
        enum: [blocked]
      example: blocked

    sha256Param:
      name: sha256
      in: query
      description: A SHA-256 hash.
      schema:
        type: string
      example: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

    antivirusThreatsParam:
      name: antivirusthreats
      in: query
      description: |-
        A threat name or comma-delimited list of threat names.
      schema:
        type: string
      example: Trojan.Linux.Generic.144075

    xTrafficTypeParam:
      name: x-traffic-type
      in: header
      description: |-
        A string or comma-delimited list of strings that describes the type of traffic.
        If the header is not set, the default value is `all`. Valid values are: `dns`, `proxy`, `firewall`, and `ip`.
      schema:
        type: string
      example: dns,proxy,firewall,ip

    tenantControlsParam:
      name: tenantcontrols
      in: query
      description: If set to `true`, filter data for requests that are part of a tenant control policy.
      schema:
        type: boolean
      example: true

    typeDnsWebParam:
      name: type
      in: path
      description: Specify the type of traffic.
      required: true
      schema:
        type: string
        enum: [dns, proxy]
      example: dns

    typeDnsWebIpParam:
      name: type
      in: path
      description: Specify the type of traffic.
      required: true
      schema:
        type: string
        enum: [dns, proxy, ip]
      example: ip

    typeDnsWebIpFirewallParam:
      name: type
      in: path
      description: Specify the type of traffic.
      required: true
      schema:
        type: string
        enum: [dns, proxy, firewall, ip]
      example: firewall

    typeAllParam:
      name: type
      in: path
      description: Specify the type of traffic.
      required: true
      schema:
        type: string
        enum: [dns, proxy, firewall, intrusion, ip]
      example: intrusion
    #typeWebIntrusionParam:
    #  name: type
    #  in: path
    #  description: |-
    #    Specify the type of traffic. Valid values: proxy or intrusion.
    #  required: true
    #  schema:
    #    type: string
    #  example: intrusion
    identityIdParam:
      name: identityid
      in: path
      description: An identity ID.
      required: true
      schema:
        type: number
      example: 42

    threatTypeIdParam:
      name: threattypeid
      in: path
      description: The name of the threat type.
      required: true
      schema:
        type: string
      example: Ransomware

    searchParam:
      name: search
      in: query
      description: |-
        A string that represents a search parameter.
        Filter data for requests where the search string appears in the endpoint data.
      schema:
        type: string
      example: somelabel

    threatNameIdParam:
      name: threatnameid
      in: path
      description: The name of the threat.
      required: true
      schema:
        type: string
      example: WannaCry

    timerangeParam:
      name: timerange
      in: header
      description: |-
        A string that represents a range of time.
        If the header is not set, the header value defaults to `hour`.
      # Valid values are: `minute`, `hour`, or `day`.
      schema:
        type: string
        enum:
          - minute
          - hour
          - day
      example: minute

    applicationNameParam:
      name: application
      in: query
      description: Filter on the name of the application.
      schema:
        type: string
      example: Games

    filterNoisyDomainsParam:
      name: filternoisydomains
      in: query
      description: Filter out domains that generate a lot of insignificant traffic (noise).
      schema:
        type: boolean
      example: true

    httpErrorsParam:
      name: httperrors
      in: query
      description: |-
        Filter data for requests that resulted in a TLS error or a certificate error.
      # Valid values are: `certificateerror` or `tlserror`.
      schema:
        type: string
        enum: [certificateerror, tlserror]
      example: certificateerror

    signaturesParam:
      name: signatures
      in: query
      description: 'The signature or comma-separated list of <signatureid>-<generatorid> signatures.'
      schema:
        type: string
      example: '1-2,1-4'

    signatureListIdsParam:
      name: signaturelistids
      in: query
      description: The signature ID or comma-separated list of signature list IDs.
      schema:
        type: string
      example: '1,2'
    intrusionActionParam:
      name: intrusionaction
      in: query
      description: |-
        An action or list of comma-separated intrusion actions. Valid values are: `would_block`, `blocked`, and `detected`.
      schema:
        type: string
      example: detected,would_block

    existsParam:
      name: exists
      in: query
      description: |-
        Specify an attribute or comma-separated list of attributes to filter the data.
        Valid values are: `categories`, `policycategories`, `applicationid`,
        `nbarapplicationid`, `nbarapplicationtypeids`, `privateapplicationid`, `applicationgroupids`,
        `sha256`, `filename`, `threats`, `threattypes`, `antivirusthreats`, `destinationlistids`, and `httperrors`.
      schema:
        type: string
      example: destinationlistids,threattypes

    connectioneventParam:
      name: connectionevent
      in: query
      description: Specify the type of connection event.
      schema:
        type: string
        enum: [connected, disconnected, failed]
      example: connected

    osversionsParam:
      name: osversions
      in: query
      description: Specify a comma-separated list of OS versions.
      schema:
        type: string
      example: linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)

    anyconnectversionsParam:
      name: anyconnectversions
      in: query
      description: Specify a comma-separated list of AnyConnect Roaming Security module versions.
      schema:
        type: string
      example: '4.10.05095,5.10'

  schemas:

    verdict:
      type: string
      description: The verdict for the entry.
      enum: [allowed, blocked]
      example: allowed

    verdictDetected:
      type: string
      description: The verdict for the entry.
      enum: [detected]
      example: detected

    categories:
      type: array
      description: The list of categories.
      items:
        $ref: '#/components/schemas/Category'

    policycategories:
      type: array
      description: The list of policy categories.
      items:
        $ref: '#/components/schemas/Category'

    identities:
      type: array
      description: The list of identities for the entry.
      items:
        $ref: '#/components/schemas/Identity'

    allapplications:
      type: array
      description: The list of applications for the entry.
      items:
        $ref: '#/components/schemas/Application'

    sha256:
      type: string
      description: The SHA256 hash for the entry.

    ActivityProxy:
      type: object
      description: The activity of the proxy.
      properties:
        externalip:
          type: string
          description: The external IP for the entry.
        internalip:
          type: string
          description: The internal IP for the entry.
        policycategories:
          $ref: '#/components/schemas/policycategories'
        categories:
          $ref: '#/components/schemas/categories'
        verdict:
          $ref: '#/components/schemas/verdict'
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        identities:
          $ref: '#/components/schemas/identities'
        allapplications:
          $ref: '#/components/schemas/allapplications'
        allowedapplications:
          type: array
          description: The list of allowed applications for the entry.
          items:
            $ref: '#/components/schemas/Application'
        blockedapplications:
          type: array
          description: The list of blocked applications for the entry.
          items:
            $ref: '#/components/schemas/Application'
        responsefilename:
          type: string
          description: The response filename for the entry.
        blockedfiletype:
          type: string
          description: The blocked file type for the entry.
        bundleid:
          type: number
          description: The ID of the bundle type.
        amp:
          $ref: '#/components/schemas/CiscoAMP'
        type:
          type: string
          description: The type of the request. A proxy request is always of type 'proxy'.
        tenantcontrols:
          type: boolean
          description: Specifies whether the request is part of a tenant control policy.
        port:
          type: number
          description: The port used to make the request.
          nullable: true
        antivirusthreats:
          $ref: '#/components/schemas/AntivirusThreats'
        policy:
          $ref: '#/components/schemas/Policy'
        requestmethod:
          type: string
          description: The HTTP request method.
          example: GET
        responsesize:
          type: number
          description: The response size in bytes.
        requestsize:
          type: number
          description: The response size in bytes.
        statuscode:
          type: number
          description: The HTTP status code (`200` or `201`).
          enum: [200, 201]
          example: 200
        useragent:
          type: string
          description: The name of the browser that made the request.
        referer:
          type: string
          description: The referring domain or URL.
        warnstatus:
          type: string
          description: The warning status.
        sha256:
          type: string
          description: The hex digest of the response content.
        isolated:
          $ref: '#/components/schemas/Isolated'
        datalossprevention:
          $ref: '#/components/schemas/DataLossPreventionState'
        securityoverridden:
          type: boolean
          description: Specifies whether security overrides are configured.
        contenttype:
          type: string
          description: The type of web content, typically text/html.
          example: text/html
        forwardingmethod:
          type: string
          description: The request method (GET, POST, HEAD, etc.)
          example: GET
        httperrors:
          type: array
          items:
            $ref: '#/components/schemas/HttpError'
          description: Certificate & TLS Errors
        threats:
          type: array
          items:
            $ref: '#/components/schemas/Threat'
        egress:
          $ref: '#/components/schemas/Egress'
        datacenter:
          $ref: '#/components/schemas/DataCenter'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
        destinationip:
          $ref: '#/components/schemas/DestinationIp'
        url:
          type: string
          description: The URL that was requested.
      required:
        - allapplications
        - allowedapplications
        - amp
        - antivirusthreats
        - blockedapplications
        - blockedfiletype
        - bundleid
        - categories
        - contenttype
        - datacenter
        - datalossprevention
        - date
        - destinationip
        - egress
        - externalip
        - forwardingmethod
        - httperrors
        - identities
        - internalip
        - isolated
        - policy
        - policycategories
        - port
        - referer
        - requestsize
        - responsefilename
        - responsesize
        - securityoverridden
        - sha256
        - statuscode
        - tenantcontrols
        - threats
        - time
        - timestamp
        - type
        - url
        - useragent
        - verdict
        - warnstatus
      example:
        destinationip: ''
        externalip: 32.4.91.7
        responsesize: 3329530
        allapplications:
          - id: 1313
            label: Netflix
            category:
              id: 47
              label: Media
        date: '2022-02-18'
        datalossprevention:
          state: ''
        antivirusthreats:
          puas: []
          viruses: []
          others: []
        internalip: 192.168.1.43
        referer: ''
        contenttype: ''
        tenantcontrols: false
        securityoverridden: false
        useragent: ''
        time: '23:29:42'
        amp:
          disposition: ''
          score: 0
          malware: ''
        policycategories: []
        type: proxy
        requestsize: 1996
        port: 443
        policy:
          ruleid: 0
          rulesetid: 0
          destinationlistids: []
          timebasedrule: false
        forwardingmethod: ''
        categories:
          - id: 17
            type: content
            label: Movies
            integration: false
            deprecated: true
        isolated:
          state: not-isolated
          fileaction: ''
        statuscode: 200
        egress:
          ip: 155.190.3.8
          type: shared
        blockedfiletype: ''
        url: https://ipv4-lax2-ix.1.oca.anothervideo.net
        verdict: allowed
        responsefilename: ''
        warnstatus: ''
        sha256: ''
        timestamp: 1645226982000
        blockedapplications: []
        allowedapplications: []
        identities:
          - id: 1
            type:
              id: 34
              type: anyconnect
              label: Anyconnect Roaming Client
            label: Vincent's Macbook
            deleted: false
        datacenter:
          label: Atlanta, US
          id: ATL
        threats: []
        httperrors: []
        bundleid: 3

    ActivityFirewall:
      type: object
      description: The information about the firewall activity.
      properties:
        date:
          $ref: '#/components/schemas/Date'
        destinationip:
          $ref: '#/components/schemas/DestinationIp'
        sourceip:
          $ref: '#/components/schemas/SourceIp'
        sourceport:
          $ref: '#/components/schemas/SourcePort'
        destinationport:
          $ref: '#/components/schemas/DestinationPort'
        categories:
          $ref: '#/components/schemas/categories'
        verdict:
          $ref: '#/components/schemas/verdict'
        time:
          $ref: '#/components/schemas/Time'
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        identities:
          $ref: '#/components/schemas/identities'
        protocol:
          $ref: '#/components/schemas/Protocol'
        rule:
          $ref: '#/components/schemas/Rule'
        type:
          type: string
          description: The type of the request. A firewall request always has type firewall.
          example: firewall
        allapplications:
          type: array
          description: A list of firewall applications
          items:
            $ref: '#/components/schemas/FirewallApplication'
        applicationprotocols:
          type: array
          description: A list of firewall application protocols.
          items:
            $ref: '#/components/schemas/FirewallApplication'
        direction:
          type: string
          description: The direction of the packet. It is destined either towards the internet or to the customer's network.
        packetsize:
          type: number
          description: The size of the packet that was received.
      required:
        - allapplications
        - applicationprotocols
        - date
        - destinationip
        - destinationport
        - direction
        - identities
        - packetsize
        - protocol
        - rule
        - sourceip
        - sourceport
        - time
        - timestamp
        - type
        - verdict
      example:
        date: ""
        destinationip: 52.8.160.247
        sourceip: 192.168.0.1
        sourceport: 0
        destinationport: 0
        direction: toward
        categories:
        - id: 66
          label: Malware
          type: security
          integration: true
        verdict: allowed
        time: '12:34'
        timestamp: 1548311506000
        packetsize: 32
        identities:
          - id: 1
            label: Catch Rate Testing System
            type:
              id: 21
              label: Sites
              type: site
            deleted: false
        protocol:
          id: 17
          label: UDP
        rule:
          id: 1
          label: Default Rule
        type: firewall
        allapplications:
          - id: 72
            label: 'dns IT Service Management'
            app: ""
        applicationprotocols:
          - id: 72
            label: 'dns IT Service Management'
            app: ""

    ActivityIntrusion:
      type: object
      description: The information about the intrusion activity.
      properties:
        classification:
          $ref: '#/components/schemas/Classification'
        date:
          $ref: '#/components/schemas/Date'
        destinationip:
          $ref: '#/components/schemas/DestinationIp'
        destinationport:
          $ref: '#/components/schemas/DestinationPort'
        identities:
          $ref: '#/components/schemas/identities'
        protocol:
          $ref: '#/components/schemas/Protocol'
        sessionid:
          $ref: '#/components/schemas/SessionId'
        severity:
          $ref: '#/components/schemas/Severity'
        signature:
          $ref: '#/components/schemas/Signature'
        signaturelist:
          $ref: '#/components/schemas/SignatureList'
        sourceip:
          $ref: '#/components/schemas/SourceIp'
        sourceport:
          $ref: '#/components/schemas/SourcePort'
        time:
          $ref: '#/components/schemas/Time'
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        type:
          type: string
          description: The type of the request. An intrusion request always has type intrusion.
          example: intrusion
        verdict:
          $ref: '#/components/schemas/verdictDetected'
      required:
        - classification
        - date
        - destinationip
        - destinationport
        - identities
        - protocol
        - sessionid
        - severity
        - signature
        - signaturelist
        - sourceip
        - sourceport
        - time
        - timestamp
        - type
        - verdict
      example:
        type: intrusion
        date: "12-02-22"
        destinationip: "10.10.10.10"
        protocol:
          id: 17
          label: UDP
        sourceip: "10.10.10.10"
        signaturelist:
          id: 1111
        classification: malicious
        sourceport: 22
        sessionid: 190898098
        verdict: detected
        destinationport: 33
        timestamp: 1594557262000
        time: '09:30'
        identities:
          - id: 211034846
            type:
              id: 34
              type: anyconnect
              label: Anyconnect Roaming Client
            label: omerta
            deleted: false
        severity: HIGH
        signature:
          generatorid: 1
          id: 47829
          label: SERVER-OTHER JBoss Richfaces expression language injection attempt
          cves:
            - "cve-2015-0279"
            - "cve-2018-12532"

    #ActivityIP:
    #  type: object
    #  properties:
    #    date:
    #      $ref: '#/components/schemas/Date'
    #    destinationip:
    #      $ref: '#/components/schemas/DestinationIp'
    #    sourceip:
    #      $ref: '#/components/schemas/SourceIp'
    #    sourceport:
    #      $ref: '#/components/schemas/SourcePort'
    #    destinationport:
    #      $ref: '#/components/schemas/DestinationPort'
    #    verdict:
    #      type: string
    #      description: verdict for entry, allowed or blocked
    #    time:
    #      $ref: '#/components/schemas/Time'
    #    timestamp:
    #      $ref: '#/components/schemas/Timestamp'
    #    identities:
    #      type: array
    #      description: array of identities for entry
    #      items:
    #        $ref: "#/components/schemas/Identity"
    #    categories:
    #      type: array
    #      items:
    #        $ref: '#/components/schemas/Category'
    #    type:
    #      type: string
    #      description: type of the request. an ip request always has type ip
    #  required:
    #    - categories
    #    - date
    #    - destinationip
    #    - destinationport
    #    - identities
    #    - sourceip
    #    - sourceport
    #    - time
    #   - timestamp
    #    - type
    #    - verdict
    #  example:
    #    destinationip: 52.8.160.247
    #    sourceip: 192.168.0.1
    #    date: "02-15-2022"
    #    sourceport: 0
    #    destinationport: 0
    #    verdict: allowed
    #    time: '10:15'
    #    timestamp: 1548311506000
    #    identities:
    #      - id: 1
    #        label: Catch Rate Testing System
    #        type:
    #          id: 21
    #          label: Sites
    #          type: site
    #        deleted: false
    #    categories:
    #      - id: 66
    #        label: Malware
    #        type: security
    #        integration: true
    #    type: ip

    IdentityDistribution:
      type: object
      description: The information about the identity distribution.
      properties:
        counts:
          $ref: '#/components/schemas/RequestCounts'
        requests:
          type: number
          description: The requests made by the identity type.
        unique_identity_count:
          type: number
          description: The number unique identities associated with the identity type.
        identitytype:
          $ref: '#/components/schemas/IdentityType'
      required:
        - counts
        - identitytype
        - requests
        - unique_identity_count
      example:
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        requests: 312
        unique_identity_count: 12
        identitytype:
          id: 21
          label: Sites
          name: site

    OrganizationDeploymentStatus:
      type: object
      description: The deployment status for the organization.
      required:
        - organization
        - counts
      properties:
        organization:
          $ref: '#/components/schemas/Organization'
        counts:
          type: array
          items:
            $ref: '#/components/schemas/ProviderDeploymentStatus'
      example:
        organization:
          id: 232323
          label: Company Name Goes Here
        counts:
          - identitytype:
              id: 21
              label: Sites
              name: site
            activecount: 1
            count: 1
    BandwidthbyHour:
      type: object
      description: The information about the bandwidth by hour.
      properties:
        inboundbytes:
          type: number
          description: The number of inbound bytes.
        outboundbytes:
          type: number
          nullable: true
          description: The number of outbound bytes.
        timestamp:
          $ref: '#/components/schemas/TimestampForBucket'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
      required:
        - date
        - inboundbytes
        - outboundbytes
        - time
        - timestamp
      example:
        inboundbytes: 123
        outboundbytes: 456
        timestamp: 1559836800000
        date: '2019'
        time: '16:00:00'

    TopFile:
      type: object
      description: The information about the top file requests.
      properties:
        requests:
          type: number
          description: The number of requests for the file.
        sha256:
          $ref: '#/components/schemas/sha256'
        categories:
          $ref: '#/components/schemas/categories'
        identitycount:
          type: number
          description: The count of the identities for the entry.
        filenames:
          type: array
          description: The list of filenames for the entry.
          items:
            type: string
        filetypes:
          type: array
          description: The list of filetypes for the entry.
          items:
            type: string
      required:
        - categories
        - filenames
        - filetypes
        - identitycount
        - requests
        - sha256
      example:
        requests: 123
        sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
        categories:
          - id: 66
            label: Malware
            type: security
            integration: true
        identitycount: 1
        filenames: []
        filetypes: []

    TopThreats:
      type: object
      description: The information about the top threats.
      properties:
        threat:
          type: string
          description: The name of the threat.
        threattype:
          type: string
          description: The type of the threat.
        count:
          type: number
          description: The number of requests for the threat name.
      required:
        - count
        - threat
        - threattype
      example:
        threat: Wannacry
        threattype: Ransomware
        count: 361

    TopThreatTypes:
      type: object
      description: The information about the top types of threat.
      properties:
        threattype:
          type: string
          description: The type of the threat.
        threatscount:
          type: number
          description: The count of the threats for the threat type.
        count:
          type: number
          description: The number of requests for the threat type.
      required:
        - count
        - threatscount
        - threattype
      example:
        threattype: Ransomware
        threatscount: 10
        count: 361

    Identity:
      type: object
      description: The information about the identity.
      properties:
        id:
          type: number
          description: The ID of the identity.
        label:
          type: string
          description: The descriptive label for the identity.
        type:
          $ref: '#/components/schemas/IdentityType'
        deleted:
          type: boolean
          description: Indicates whether the identity was deleted.
          example: true
      required:
        - id
        - label
        - type
        - deleted
      example:
        id: 1
        label: Catch Rate Testing System
        type:
          id: 21
          label: Sites
          type: site
        deleted: false

    Summary:
      type: object
      description: The summary information about the requests.
      properties:
        applications:
          type: number
          description: The total number of applications (avc or total).
        domains:
          type: number
          description: The total number of domains.
        requestsblocked:
          type: number
          description: The total number of domains.
        filetypes:
          type: number
          description: The total number of domains.
        policycategories:
          type: number
          description: The total number of blocked categories.
        policyrequests:
          type: number
          description: The total number of policy requests.
        requests:
          type: number
          description: The total number of requests.
        requestsallowed:
          type: number
          description: The total number of allowed requests.
        categories:
          type: number
          description: The total number of categories.
        identitytypes:
          type: number
          description: The total number of identity types.
        applicationsblocked:
          type: number
          description: The total number of blocked applications.
        files:
          type: number
          description: The total number of files.
        identities:
          type: number
          description: The total number of identities.
        applicationsallowed:
          type: number
          description: The total number of allowed applications.
      required:
        - applications
        - applicationsallowed
        - applicationsblocked
        - categories
        - domains
        - files
        - filetypes
        - identities
        - identitytypes
        - policycategories
        - policyrequests
        - requests
        - requestsallowed
        - requestsblocked
      example:
        applications: 123
        domains: 82
        requestsblocked: 189
        filetypes: 0
        policycategories: 2
        policyrequests: 2
        requests: 189
        requestsallowed: 10
        categories: 11
        identitytypes: 1
        applicationsblocked: 2
        files: 5
        identities: 1
        applicationsallowed: 2

    Protocol:
      type: object
      description: The properties of the protocol.
      properties:
        id:
          type: number
          description: The ID of protocol.
        label:
          type: string
          description: The name of the protocol.
      required:
        - id
        - label

    Rule:
      type: object
      description: The properties of the firewall rule.
      properties:
        id:
          type: number
          description: The ID of the rule.
        label:
          type: string
          description: The name of the rule.
        privateapplicationgroup:
          $ref: '#/components/schemas/PrivateApplicationGroup'
      required:
        - id
        - label
    PrivateApplicationGroup:
      type: object
      description:  The private application group.
      properties:
        id:
          nullable: true
          type: number
          description: The ID of application group.
        label:
          nullable: true
          type: string
          description: The name of the application group.

    IdentityType:
      type: object
      description: The information about the identity including the type.
      properties:
        id:
          type: number
          description: The ID of the origin type for the identity.
        label:
          type: string
          description: The label of the origin type for the identity.
        type:
          type: string
          description: The name of the origin type for the identity.

    CategoryWithLegacyId:
      type: object
      description: The information about the category with legacy ID.
      properties:
        id:
          type: number
          description: The ID of the category.
        legacyid:
          type: number
          description: The legacy category ID.
        label:
          type: string
          description: The label of the category.
        type:
          type: string
          description: The type of the category.
        integration:
          type: boolean
          description: Specifies whether the category is an integration.
        deprecated:
          type: boolean
          description: Specifies whether the legacy category is deprecated.
          example: true
      required:
        - id
        - integration
        - label
        - legacyid
        - type
        - deprecated
      example:
        id: 66
        legacyid: 94
        label: Malware
        type: security
        integration: true
        deprecated: false

    Category:
      type: object
      description: The properties of the category.
      properties:
        id:
          type: number
          description: The ID of the category.
        label:
          type: string
          description: The descriptive label for the category.
        type:
          type: string
          description: The type of the category.
        integration:
          type: boolean
          description: Specifies whether the category is an integration.
          example: true
        deprecated:
          type: boolean
          description: Specifies whether the category is a legacy category.
          example: true

    rank:
      type: number
      description: The rank of the result based on the number of requests.

    TopIdentity:
      type: object
      description: The information about the top identity requests.
      properties:
        requests:
          type: number
          description: The total number of requests made by this identity.
        bandwidth:
          $ref: '#/components/schemas/bandwidth'
        identity:
          $ref: '#/components/schemas/Identity'
        counts:
          $ref: '#/components/schemas/RequestCounts'
        rank:
          $ref: '#/components/schemas/rank'
      required:
        - bandwidth
        - counts
        - identity
        - rank
        - requests
      example:
        requests: 3827
        bandwidth: 7051943359
        identity:
          id: 1
          label: Catch Rate Testing System
          type:
            id: 21
            label: Sites
            type: site
          deleted: false
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        rank: 3

    bandwidth:
      type: number
      nullable: true
      description: The amount of bandwidth

    TopDestination:
      type: object
      description: The information about the top destination requests.
      properties:
        bandwidth:
          $ref: '#/components/schemas/bandwidth'
        rank:
          $ref: '#/components/schemas/rank'
        domain:
          type: string
          description: The domain name.
        count:
          type: number
          description: The total number of requests made for this destination.
        counts:
          $ref: '#/components/schemas/RequestCounts'
        categories:
          $ref: '#/components/schemas/categories'
        policycategories:
          type: array
          description: |-
            The policy categories that are associated with the destination.
          items:
            $ref: "#/components/schemas/Category"
      required:
        - bandwidth
        - categories
        - count
        - counts
        - domain
        - policycategories
        - rank
      example:
        bandwidth: 223437
        rank: 4
        domain: google.com
        count: 3827
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        categories:
          - id: 66
            label: Malware
            type: security
            integration: true
        policycategories:
          - id: 66
            label: Malware
            type: security
            integration: true

    TopCategory:
      type: object
      description: The information about the top category requests.
      properties:
        rank:
          $ref: '#/components/schemas/rank'
        category:
          $ref: '#/components/schemas/Category'
        count:
          type: number
          description: The number of requests that match this category.
        bandwidth:
          $ref: '#/components/schemas/bandwidth'
      required:
        - category
        - count
        - rank
      example:
        rank: 5
        category:
          id: 66
          label: Malware
          type: security
          integration: true
        count: 3827

    TopEventType:
      type: object
      description: The information about the top events.
      properties:
        eventtype:
          type: string
          description: The type of the event.
          #One of "domain_security", "domain_integration",
          #  "url_security", "url_integration", "cisco_amp" and "antivirus"
          enum: [domain_security, domain_integration, url_security, url_integration, cisco_amp, antivirus]
        count:
          type: number
          description: The number of requests that match the event type (`eventtype`).
      required:
        - count
        - eventtype
      example:
        eventtype: domain_security
        count: 3827

    RequestsbyHour:
      type: object
      description: The information about the requests by hour.
      properties:
        count:
          type: number
          description: The number of requests in the hour.
          example: 123
        counts:
          $ref: '#/components/schemas/RequestCounts'
        timestamp:
          $ref: '#/components/schemas/TimestampForBucket'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
      required:
        - count
        - counts
        - date
        - time
        - timestamp
      example:
        count: 123
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        timestamp: 1559836800000
        date: '2019'
        time: '16:00:00'
    RequestsbyOrganization:
      type: object
      description:  The information about the requests by organization.
      properties:
        organization:
          $ref: '#/components/schemas/Organization'
        counts:
          $ref: '#/components/schemas/RequestsByOrgCounts'
      required:
        - counts
        - organization
      example:
        organization:
          id: 232323
          label: Company Name Goes Here
        counts:
          total: 1
          totalblocked: 1
    RequestsbyCategory:
      type: object
      description: The information about the requests by category.
      properties:
        category:
          $ref: '#/components/schemas/Category'
        counts:
          $ref: '#/components/schemas/ProviderCountsByCategory'
      required:
        - category
        - counts
      example:
        category:
          id: 66
          label: Malware
          type: security
          integration: true
        counts:
          total: 1
          totalblocked: 1
          numberoforganizationsaffected: 1
    ProviderRequestsbyDestination:
      type: object
      description: The information about the provider's requests by destination.
      properties:
        domain:
          type: string
        categories:
          type: array
          items:
            $ref: "#/components/schemas/Category"
        counts:
          $ref: '#/components/schemas/ProviderCountsByDestination'
      required:
        - categories
        - counts
        - domain
      example:
        domain: ""
        categories:
          - id: 66
            label: Malware
            type: security
            integration: true
        counts:
          total: 1
          totalblocked: 1
          numberoforganizationsaffected: 1
    CategoryByHour:
      required:
        - counts
        - date
        - time
        - timestamp
      type: object
      description: The information about the categories seen by hour.
      properties:
        timestamp:
          $ref: '#/components/schemas/TimestampForBucket'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
        counts:
          type: array
          description: The list of counts for the category.
          items:
            $ref: '#/components/schemas/CategoryCount'
      example:
        timestamp: 1559836800000
        date: '2019'
        time: '16:00:00'
        counts:
          - category:
              id: 66
              label: Malware
              type: security
              integration: true
            requests: 123

    CategoryCount:
      type: object
      description: The information about the category counts.
      properties:
        category:
          $ref: '#/components/schemas/Category'
        requests:
          type: number
          description: The total number of requests for the category.
      required:
        - category
        - requests
      example:
        category: {}
        requests: 24

    Application:
      type: object
      description: The information about the application.
      properties:
        id:
          type: number
          description: The ID of the application.
        label:
          type: string
          description: The descriptive label for the application.
        type:
          type: string
          description: |-
            The type of the application: NBAR or AVC.
          enum: [NBAR, AVC]
          example: AVC
        category:
          type: object
          description: The category of the application.
          properties:
            id:
              type: number
              description: The ID of the application category.
            label:
              type: string
              description: The label of the application category.
      example:
        id: 1
        label: malware
        type: AVC
        category:
          id: 2
          label: Education

    ApplicationCategories:
      type: object
      description: The information about the applications.
      properties:
        id:
          type: number
          description: The ID of the application category.
          example: 1234
        name:
          type: string
          description: The name of the application category.
          example: Travel
      example:
        id: 1234
        name: Travel
    ApplicationsWithCategories:
      type: object
      description: The information about the applications and categories.
      properties:
        applications:
          type: array
          description: The list of applications.
          items:
            $ref: '#/components/schemas/Application'
        categories:
          type: array
          description: The list of application categories.
          items:
            $ref: '#/components/schemas/ApplicationCategories'
      example:
        applications:
          - id: 1
            label: Web Hosting
            type: AVC
            category:
              id: 40
              label: Hosting Services
        categories:
          - id: 42
            name: Education

    FirewallApplication:
      type: object
      description: The information about the applications managed by the firewall.
      properties:
        id:
          type: number
          description: The ID of the application or protocol.
        label:
          type: string
          description: The descriptive label for the application or protocol.
        app:
          type: string
          description: The information about the app type.
          example: IT Service Management (string) - application/protocol type

    ActivityDns:
      type: object
      description: The information about the DNS activity.
      properties:
        externalip:
          type: string
          description: The external IP for the entry.
        internalip:
          type: string
          description: The internal IP for the entry.
        policycategories:
          type: array
          description: The list of the policy categories.
          items:
            $ref: '#/components/schemas/Category'
        categories:
          $ref: '#/components/schemas/categories'
        verdict:
          $ref: '#/components/schemas/verdict'
        domain:
          type: string
          description: The domain name for the entry.
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        identities:
          $ref: '#/components/schemas/identities'
        allapplications:
          type: array
          description: The list of all applications for the entry.
          items:
            $ref: '#/components/schemas/Application'
        threats:
          type: array
          description: The list of threats for the entry.
          items:
            $ref: '#/components/schemas/Threat'
        type:
          type: string
          description: The type of the request. A DNS request always has the type dns.
          enum: [dns]
          example: dns
        querytype:
          type: string
          description: |-
            The type of DNS request that was made. For more information,
            see Common DNS Request Types.
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
        returncode:
          type: number
          description: |-
            The DNS return code for this request.
            For more information, see Common DNS return codes for any
            DNS service (and Umbrella).
        allowedapplications:
          type: array
          description: The list of allowed applications.
          items:
            $ref: '#/components/schemas/Application'
        blockedapplications:
          type: array
          description: The list of blocked applications.
          items:
            $ref: '#/components/schemas/Application'
      required:
        - allapplications
        - allowedapplications
        - blockedapplications
        - categories
        - date
        - domain
        - externalip
        - identities
        - internalip
        - policycategories
        - querytype
        - returncode
        - threats
        - time
        - timestamp
        - type
        - verdict
      example:
        externalip: 52.8.160.247
        internalip: 52.8.160.247
        policycategories:
          - id: 66
            label: Malware
            type: security
            integration: true
        categories:
          - id: 66
            label: Malware
            type: security
            integration: true
        verdict: allowed
        domain: google.com
        timestamp: 1548311506000
        time: '06:31:46'
        date: '2019-01-24'
        identities:
          - id: 1
            label: Catch Rate Testing System
            type:
              id: 21
              label: Sites
              type: site
            deleted: true
        threats:
          - label: Wannacry
            type: Ransomware
        allapplications:
          - id: 1
            label: label
            type: NBAR
            category:
              id: 1
              label: category
        allowedapplications:
          - id: 1
            label: label
            type: NBAR
            category:
              id: 1
              label: category
        querytype: MX
        returncode: 2
        blockedapplications: []
        type: dns

    ActivityAMPRetro:
      type: object
      description: The information about the AMP activity.
      properties:
        timestamp:
          $ref: '#/components/schemas/TimestampInSeconds'
        firstseenat:
          type: number
          description: The date and time (a timestamp expressed in seconds) when the malware event was first recorded.
          example: 1548311506
        disposition:
          type: string
          description: The disposition for the entry.
        score:
          type: number
          description: The score for the entry.
        hostname:
          type: string
          description: The hostname for the entry.
        malwarename:
          type: string
          description: The name of the malware for the entry.
        sha256:
          $ref: '#/components/schemas/sha256'
      required:
          - disposition
          - firstseenat
          - hostname
          - malwarename
          - score
          - sha256
          - timestamp
      example:
        timestamp: 1548311506
        firstseenat: 1548311506
        disposition: clean
        score: 10
        hostname: google.com
        malwarename: malware
        sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e

    CiscoAMP:
      type: object
      description: The properties of the AMP disposition and score for the malware.
      properties:
        score:
          type: number
          description: The AMP score.
        disposition:
          type: string
          description: The AMP disposition.
        malware:
          type: string
          description: The AMP malware.
      required:
        - disposition
        - malware
        - score

    AntivirusThreats:
      type: object
      description: The information about the antivirus threats.
      properties:
        puas:
          type: array
          description: The list of potentially unwanted applications.
          items:
            type: object
        viruses:
          type: array
          description: The list of viruses.
          items:
            type: string
        others:
          type: array
          description: The list of other antivirus threats.
          items:
            type: object
      required:
        - others
        - puas
        - viruses

    Threat:
      type: object
      description: The information about the threat.
      properties:
        label:
          type: string
          description: The descriptive label for the threat name.
        type:
          type: string
          description: The type of the threat.

    Organization:
      type: object
      description: The information about the organization.
      properties:
        id:
          type: number
          description: orgid
        label:
          type: string
          description: The name of the organization.
    RequestsByOrgCounts:
      type: object
      description: The information about the number of requests by organization.
      properties:
        total:
          type: number
          description: The total number of requests.
        totalblocked:
          type: number
          description: The total number of blocked requests.
      required:
        - total
        - totalblocked
    ProviderCategoryRequestsByOrganization:
      required:
        - counts
        - organization
      type: object
      description: |-
        The information about the provider's category requests by organization.
      properties:
        organization:
          $ref: '#/components/schemas/Organization'
        counts:
          type: array
          items:
            $ref: '#/components/schemas/CategoryRequests'
      example:
        organization:
          id: 232323
          label: Company Name Goes Here
        counts:
          - category:
              id: 66
              label: Malware
              type: security
              integration: true
            requests: 123
            requestsblocked: 34
            numberoforganizationswithcategorizedtraffic: 1

# duplicate with RequestsbyHour
#    ProviderRequestsByHour:
#      type: object
#      description: The information about the provider's requests by hour
#      properties:
#        counts:
#          properties:
#            requests:
#              type: number
#              description: total number of requests
#            allowedrequests:
#              type: number
#              description: number of requests that were allowed
#              nullable: true
#            blockedrequests:
#              type: number
#              description: number of requests that were blocked
#              nullable: true
#          required:
#            - requests
#            - allowedrequests
#            - blockedrequests
#        count:
#          type: number
#        date:
#          $ref: '#/components/schemas/Date'
#        time:
#          $ref: '#/components/schemas/Time'
#        timestamp:
#          $ref: '#/components/schemas/TimestampForBucket'
#      required:
#        - count
#        - date
#        - time
#        - timestamp
#      example:
#        counts:
#          requests: 123
#          allowedrequests: 60
#          blockedrequests: 63
#        count: 0
#        date: '2020-04-01'
#        time: '05:00:00'
#        timestamp: 1585717200000
    ProviderCountsByCategory:
      type: object
      description: The information about the provider's categories.
      properties:
        total:
          type: number
          description: The total number of requests.
        totalblocked:
          type: number
          description: The total number of blocked requests.
        numberoforganizationsaffected:
          type: number
          description: The number of organizations with traffic for that category.
      required:
        - numberoforganizationsaffected
        - total
        - totalblocked
    ProviderCountsByDestination:
      type: object
      description: The information about the provider's destinations.
      properties:
        total:
          type: number
          description: The total number of requests.
        totalblocked:
          type: number
          description: The total number of blocked requests.
        numberoforganizationsaffected:
          type: number
          description: The number of organizations with traffic for that category.
      required:
        - numberoforganizationsaffected
        - total
        - totalblocked
    ProviderDeploymentStatus:
      type: object
      description: The information about the provider's deployment status.
      properties:
        identitytype:
          $ref: '#/components/schemas/IdentityType'
        activecount:
          type: number
          description: The number of active identity types.
        count:
          type: number
          description: The total number of identity type.
      required:
        - activecount
        - count
        - identitytype
      example:
        identitytype:
          id: 21
          label: Sites
          name: site
        activecount: 1
        count: 1
    CategoryRequests:
      type: object
      description: The information about categories and requests.
      properties:
        category:
          $ref: '#/components/schemas/Category'
        requests:
          type: number
          description: The number of requests.
        requestsblocked:
          type: number
          description: The number of requests that were blocked.
        numberoforganizationswithcategorizedtraffic:
          type: number
          description: The number of organizations with traffic for that category.
    DataCenter:
      type: object
      description: The information about the data center.
      properties:
        id:
          type: string
          description: The unique ID for the data center.
        label:
          type: string
          description: The name of the data center.
      required:
        - id
        - label
      example:
        id: LAX
        label: Los Angeles, US

    DataLossPreventionState:
      type: object
      description: The information about the Data Loss Prevention state.
      properties:
        state:
          type: string
          description: Indicates the status of the DLP. The state is either `blocked` or the empty string (` `).
          enum: [blocked, '']
      required:
        - state
      example:
        state: blocked

    DeploymentStatus:
      type: object
      description: The information about the deployment status.
      properties:
        type:
          $ref: '#/components/schemas/IdentityType'
        activecount:
          type: number
          description: The count of the active identity type.
        count:
          type: number
          description: The total count of the identity type.
      required:
        - activecount
        - count
        - type
      example:
        type:
          id: 21
          label: Sites
          name: site
        activecount: 1
        count: 1

    Egress:
      type: object
      description: The information about the egress IP.
      properties:
        ip:
          type: string
          description: The egress IP.
        type:
          type: string
          description: The type of the egress IP.
          example: shared
      required:
        - ip
        - type
      example:
        ip: "155.190.3.8"
        type: shared

    TopIP:
      type: object
      description: The information about the top IP addresses.
      properties:
        ip:
          type: string
          description: The comma-delimited list of IP addresses.
        count:
          type: number
          description: The number of requests to the top IP addresses.
      required:
        - count
        - ip
      example:
        ip: 10.0.0.1
        count: 42

    RequestCounts:
      type: object
      description: The information about the requests.
      properties:
        requests:
          type: number
          description: The total number of requests.
        allowedrequests:
          type: number
          description: The number of requests that were allowed.
        blockedrequests:
          type: number
          description: The number of requests that were blocked.

    requests:
      type: number
      description: The total number of requests.

    TopDnsQueryType:
      type: object
      description: The information about the top DNS queries.
      properties:
        requests:
          $ref: '#/components/schemas/requests'
        querytype:
          type: string
          description: The type of the DNS query.
          example: AAAA
      required:
        - querytype
        - requests
      example:
        requests: 123
        querytype: A

    count:
      type: number
      description: The total number of requests.

    TopURL:
      type: object
      description: The information about the top URLs.
      properties:
        count:
          $ref: '#/components/schemas/count'
        path:
          type: string
          description: The URL path.
        categories:
          $ref: '#/components/schemas/categories'
        rank:
          type: number
          description: The numeric rank of the top URL.
      required:
        - categories
        - count
        - path
        - rank
      example:
        count: 123
        path: ""
        categories:
          - id: 66
            label: Malware
            type: security
            integration: true
        rank: 1

    TotalRequest:
      type: object
      description: The total number of requests.
      properties:
        count:
          $ref: '#/components/schemas/count'
      required:
        - count
      example:
        count: 42
    SummaryWithCategory:
      type: object
      description: The properties of the category and summary.
      properties:
        category:
          $ref: '#/components/schemas/Category'
        summary:
          $ref: '#/components/schemas/Summary'
      required:
        - category
        - summary
      example:
        category:
          id: 66
          label: Malware
          type: security
          integration: true
        summary:
          applications: 123
          domains: 82
          requestsblocked: 189
          filetypes: 0
          policycategories: 2
          policyrequests: 2
          requests: 189
          requestsallowed: 10
          categories: 11
          identitytypes: 1
          applicationsblocked: 2
          files: 5
          identities: 1
          applicationsallowed: 2

    SummaryWithDestination:
      type: object
      description: The summary and destination information.
      properties:
        domain:
          type: string
          description: destination domain
        summary:
          $ref: '#/components/schemas/Summary'
      required:
        - domain
        - summary
      example:
        domain: www.google.com
        summary:
          applications: 123
          domains: 82
          requestsblocked: 189
          filetypes: 0
          policycategories: 2
          policyrequests: 2
          requests: 189
          requestsallowed: 10
          categories: 11
          identitytypes: 1
          applicationsblocked: 2
          files: 5
          identities: 1
          applicationsallowed: 2

    SignatureListSummary:
      type: object
      description: The summary information about the signature lists.
      properties:
        signaturelist:
          $ref: '#/components/schemas/SignatureList'
        signatures:
          type: array
          description: The list of information about the signatures.
          items:
            type: object
            properties:
              generatorid:
                type: number
                description: The generator ID of the signature.
              id:
                type: number
                description: The ID of the signature.
              lasteventat:
                type: number
                description: The date and time in milliseconds of the last event.
              counts:
                type: object
                properties:
                  blocked:
                    type: number
                    description: The number of blocked signatures.
                  detected:
                    type: number
                    description: The number of detected signatures.
                  wouldblock:
                    type: number
                    description: The number of signatures to block.
                required:
                  - blocked
                  - detected
                  - wouldblock
        rule:
          $ref: '#/components/schemas/RuleParam'
      example:
        signaturelist:
          id: 1111
        signatures:
          - counts:
              blocked: 0
              detected: 1
              wouldblock: 0
            generatorid: 1
            lasteventat: 1594557262000
            id: 47829
        rule:
          id: 47

    ThreatType:
      type: object
      description: The properties of the threat type.
      properties:
        name:
          type: string
          description: The name of the threat type.
        description:
          type: string
          description: The name of the threat type.
      required:
        - name
        - description
      example:
        name: Ransomware
        description: a description

    ThreatName:
      type: object
      description: The properties of the threat name.
      properties:
        name:
          type: string
          description: The name of the threat.
        description:
          type: string
          description: The description of the threat name.
      required:
        - name
        - description
      example:
        name: WannaCry
        description: a description

    Policy:
      type: object
      description: The properties of the rules in the policy.
      required:
        - destinationlistids
        - ruleid
        - rulesetid
        - timebasedrule
      properties:
        timebasedrule:
          type: boolean
          description: Specify whether the policy triggered a time-of-day rule.
        destinationlistids:
          type: array
          description: The list of destination lists that the rules triggered.
          items:
            type: number
        ruleid:
          type: number
          description: The ID of the rule in the policy.
          nullable: true
        rulesetid:
          type: number
          description: The ID of the ruleset in the policy.
          nullable: true
    HttpError:
      type: object
      description: The properties of the HTTP error.
      properties:
        type:
          type: string
          description: The type of the error, either `CertificateError` or `TLSError`.
          enum: [CertificateError, TLSError]
        code:
          type: number
          description: The HTTP error code.
        reason:
          type: string
          description: The name of the error.
        attributes:
          type: object
          description: The properties of the additional information for the error.

    Isolated:
      type: object
      description: The properties of the isolated file.
      properties:
        state:
          type: string
          description: The state of the isolated file.
        fileaction:
          type: string
          description: The action taken for the file.
      required:
        - state
        - fileaction
      example:
        state: not-isolated
        fileaction: ""

    Meta:
      type: object
      description: The properties of the metadata.
      example: {}

    Signature:
      type: object
      description: The properties of the signature.
      properties:
        generatorid:
          type: number
          description: The unique ID that is assigned to the part of the IPS, which generated the event.
        id:
          type: number
          description: The ID that is used to uniquely identify signatures.
        label:
          type: string
          description: A descriptive label for the the signature.
        cves:
          type: array
          description: The list of common vulnerabilites and exposures (CVEs).
          items:
            $ref: '#/components/schemas/CVE'
      required:
        - generatorid
        - id
        - label
        - cves
      example:
        generatorid: 148
        id: 2
        label: (cip) CIP data is non-conforming to ODVA standard
        cves: ['cve-2015-0279']

    SignatureList:
      type: object
      description: The properties of the signature list.
      properties:
        id:
          type: number
          description: The unique ID assigned to a default or custom signature list.
      required:
        - id
      example:
        id: 1112

    RuleParam:
      type: object
      description: The properties of the rule parameter.
      properties:
        id:
          type: number
          description: The ID of the ruleset for the signature.
          example: 47

    Classification:
      type: string
      description: The category of attack detected by a rule that is part of a more general type of attack class, such as trojan-activity, attempted-user, and unknown.
      example: trojan-activity

    CVE:
      type: string
      description: An identifier for a known security vulnerability/exposure.
      example: cve-2015-0279

    Date:
      type: string
      description: The date from the timestamp based on the timezone parameter.
      example: '2020-07-12'

    DestinationIp:
      type: string
      description: The destination IP for the entry.
      example: "12.10.10.10"

    DestinationPort:
      type: number
      description: The destination port for entry.
      example: 89

    SessionId:
      type: number
      description: The unique identifier of a session, which is used to group the correlated events between various services.
      example: 7878797

    Severity:
      type: string
      description: The severity level of the rule.
    #Valid values are: `High`, `Medium`, `Low`, and `Very Low`.
      enum: [HIGH, MEDIUM, LOW, VERY LOW]
      example: HIGH

    SourceIp:
      type: string
      description: The source IP for the entry.
      example: '10.11.10.10'

    SourcePort:
      type: number
      description: The source port for the entry.
      example: 3000

    Time:
      type: string
      description: The time in 24-hour format based on the timezone parameter.
      example: '12:34'

    Timestamp:
      type: number
      description: The timestamp represented in milliseconds.
      example: 1594557263000

    TimestampInSeconds:
      type: number
      description: The timestamp represented in seconds.
      example: 1594557263

    TimestampForBucket:
      type: number
      description: The timestamp represented in milliseconds for the bucket.
      example: 1594557263000



  securitySchemes:
    oauthFlow:
      type: oauth2
      description: client credential flow
      flows:
        clientCredentials:
          tokenUrl: https://api.umbrella.com/auth/v2/token
          scopes:
            reports.granularEvents:read: 'Read reports granular events'
            reports.utilities:read: 'Read reports utilities'
            reports.aggregations:read: 'Read reports aggregations'
            reports.summariesByRule:read: 'Read reports for the summaries of the rule'
            reports.customers:read: 'Read reports for the customers'

  responses:
    400Error:
      description: Bad Request
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Bad Request
    401Error:
      description: Unauthorized
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Unauthorized
    403Error:
      description: Forbidden
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Forbidden
    404Error:
      description: Not Found
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Not Found
    500Error:
      description: Internal Server Error
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Internal Server Error
