openapi: 3.0.1
info:
  title: Reporting API
  description: |-
    The Reporting API provides the data to generate the reports as seen on the Umbrella dashboard.
  version: 1.0.0
  contact:
    name: Cloud Security Developer Community
servers:
  - url: https://reports.api.umbrella.com/{basePath}
    variables:
      basePath:
        default: v2
tags:
  - name: Activity
  - name: Top Identities
  - name: Identity Distribution
  - name: Top Destinations
  - name: Top Categories
  - name: Top Event Types
  - name: Top DNS query types
  - name: Organization Requests by Hour
  - name: Organization Requests by Timerange
  - name: Organization Requests by Hour and Category
  - name: Organization Requests by Timerange and Category
  - name: Deployment Status
  - name: MSP Deployment Status
  - name: MSP Requests by Hour
  - name: MSP Requests by Timerange
  - name: MSP Requests by Organization
  - name: MSP Requests by Category
  - name: MSP Requests by Destination
  - name: MSP Category Requests by Organization
  - name: Bandwidth by Hour
  - name: Bandwidth by Timerange
  - name: Top Files
  - name: Total Requests
  - name: Top Threats
  - name: Top Threat Types
  - name: Utility
  - name: Top IPs
  - name: Summary
  - name: Summaries by Category
  - name: Summaries by Destination
  - name: Summaries by Rule (Intrusion)
  - name: Remote Access

paths:
  /organizations/{organizationid}/activity:
    get:
      tags:
        - Activity
      summary: Activity (all)
      description: |-
        List all activity entries (dns/proxy/firewall/intrusion) within the timeframe.
        Note: The IP activity report is not available.
      operationId: getActivity
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/xTrafficTypeParam'
        - $ref: '#/components/parameters/isolatedStateParam'
        - $ref: '#/components/parameters/isolatedFileActionParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
        - $ref: '#/components/parameters/httpErrorsParam'
        - $ref: '#/components/parameters/existsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      anyOf:
                        - $ref: '#/components/schemas/ActivityDns'
                        - $ref: '#/components/schemas/ActivityFirewall'
                        - $ref: '#/components/schemas/ActivityIntrusion'
                        - $ref: '#/components/schemas/ActivityProxy'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                meta: {}
                data:
                  - externalip: 52.8.160.247
                    internalip: 52.8.160.247
                    policycategories:
                    - id: 66
                      label: Malware
                      type: security
                      integration: true
                    categories:
                    - id: 66
                      label: Malware
                      type: security
                      integration: true
                    verdict: allowed
                    domain: google.com
                    timestamp: 1548311506
                    time: "06:31:46"
                    date: "2019-01-24"
                    identities:
                    - id: 1
                      label: Catch Rate Testing System
                      type:
                        id: 21
                        label: Sites
                        type: site
                      deleted: true
                    threats:
                    - label: Wannacry
                      type: Ransomware
                    allapplications:
                      - id: 1
                        label: label
                        type: NBAR
                        category:
                          id: 1
                          label: category
                    allowedapplications:
                      - id: 1
                        label: label
                        type: NBAR
                        category:
                          id: 1
                          label: category
                    querytype: MX
                    returncode: 2
                    blockedapplications: []
                    type: dns
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/activity/dns:
    get:
      tags:
        - Activity
      summary: Activity DNS
      description: |-
        List all DNS entries within a timeframe.
      operationId: getActivityDns
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/orderParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityDns'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - externalip: 52.8.160.247
                    internalip: 52.8.160.247
                    policycategories:
                      - id: 66
                        label: Malware
                        type: security
                        integration: true
                    categories:
                      - id: 66
                        label: Malware
                        type: security
                        integration: true
                    verdict: allowed
                    domain: google.com
                    timestamp: 1548311506
                    time: "06:31:46"
                    date: "2019-01-24"
                    identities:
                      - id: 1
                        label: Catch Rate Testing System
                        type:
                          id: 21
                          label: Sites
                          type: site
                        deleted: true
                    threats:
                      - label: Wannacry
                        type: Ransomware
                    allapplications:
                      - id: 1
                        label: label
                        type: NBAR
                        category:
                          id: 1
                          label: category
                    allowedapplications:
                      - id: 1
                        label: label
                        type: NBAR
                        category:
                          id: 1
                          label: category
                    querytype: MX
                    returncode: 2
                    blockedapplications: []
                    type: dns
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/activity/proxy:
    get:
      tags:
        - Activity
      summary: Activity Proxy
      description: List all Proxy entries within timeframe.
      operationId: getActivityProxy
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/orderParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/tenantControlsParam'
        - $ref: '#/components/parameters/isolatedStateParam'
        - $ref: '#/components/parameters/isolatedFileActionParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/httpErrorsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityProxy'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - destinationip: ''
                    externalip: 32.4.91.7
                    responsesize: 3329530
                    allapplications:
                     - id: 1313
                       label: Netflix
                       category:
                         id: 47
                         label: Media
                    date: '2022-02-18'
                    datalossprevention:
                      state: ''
                    antivirusthreats:
                      puas: []
                      viruses: []
                      others: []
                    internalip: 192.168.1.43
                    referer: ''
                    contenttype: ''
                    tenantcontrols: false
                    securityoverridden: false
                    useragent: ''
                    time: '23:29:42'
                    amp:
                      disposition: ''
                      score: 0
                      malware: ''
                    policycategories: []
                    type: proxy
                    requestsize: 1996
                    port: 443
                    policy:
                      ruleid: 0
                      rulesetid: 0
                      destinationlistids: []
                      timebasedrule: false
                    forwardingmethod: ''
                    categories:
                      - id: 17
                        type: content
                        label: Movies
                        integration: false
                        deprecated: true
                    isolated:
                      state: not-isolated
                      fileaction: ''
                    statuscode: 200
                    egress:
                      ip: 155.190.3.8
                      type: shared
                    blockedfiletype: ''
                    url: https://ipv4-lax2-ix.1.oca.anothervideo.net
                    verdict: allowed
                    responsefilename: ''
                    warnstatus: ''
                    sha256: ''
                    timestamp: 1645226982000
                    blockedapplications: []
                    allowedapplications: []
                    identities:
                      - id: 1
                        type:
                          id: 34
                          type: anyconnect
                          label: Anyconnect Roaming Client
                        label: Vincent's Macbook
                        deleted: false
                    datacenter:
                      label: Los Angeles, US
                      id: LAX
                    threats: []
                    httperrors: []
                    bundleid: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/activity/firewall:
    get:
      tags:
        - Activity
      summary: Activity Firewall
      description: List all Firewall entries within timeframe.
      operationId: getActivityFirewall
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityFirewall'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                  - date: "2019"
                    destinationip: 52.8.160.247
                    sourceip: 192.168.0.1
                    sourceport: 0
                    destinationport: 0
                    verdict: allowed
                    time: "12:34"
                    timestamp: 1548311506
                    identities:
                      - id: 1
                        label: Catch Rate Testing System
                        type:
                          id: 21
                          label: Sites
                          type: site
                        deleted: false
                    protocol:
                      id: 17
                      label: UDP
                    rule:
                      id: 1
                      label: Default Rule
                    type: firewall
                    allapplications:
                      - id: 72
                        label: 'dns IT Service Management'
                        app: ""
                    applicationprotocols:
                      - id: 72
                        label: 'dns IT Service Management'
                        app: ""
                    packetsize: 32
                    direction: towards
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/activity/intrusion:
    get:
      tags:
        - Activity
      summary: Activity Intrusion
      description: List all Intrusion (IPS) entries within timeframe.
      operationId: getActivityIntrusion
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/signaturesParam'
        - $ref: '#/components/parameters/signatureListIdsParam'
        - $ref: '#/components/parameters/intrusionActionParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityIntrusion'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - type: intrusion
                    date: "12-02-22"
                    destinationip: "10.10.10.10"
                    protocol:
                      id: 17
                      label: UDP
                    sourceip: "10.10.10.10"
                    signaturelist:
                      id: 1111
                    classification: malicious
                    sourceport: 22
                    sessionid: 190898098
                    verdict: detected
                    destinationport: 33
                    timestamp: 1594557262000
                    time: "09:30"
                    identities:
                      - id: 211034846
                        type:
                          id: 34
                          type: anyconnect
                          label: Anyconnect Roaming Client
                        label: omerta
                        deleted: false
                    severity: "HIGH"
                    signature:
                      generatorid: 1
                      id: 47829
                      label: "SERVER-OTHER JBoss Richfaces expression language injection attempt"
                      cves:
                        - "cve-2015-0279"
                        - "cve-2018-12532"
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/activity/ip:
    get:
      tags:
        - Activity
      summary: Activity IP
      description: (Deprecated) List all IP entries within timeframe.
      operationId: getActivityIP
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items: {}
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data: []
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/activity/amp-retrospective:
    get:
      tags:
        - Activity
      summary: Activity AMP Retrospective
      description: List all AMP retrospective entries within timeframe.
      operationId: getActivityAmpRetrospective
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/sha256Param'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityAMPRetro'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - timestamp: 1548311506
                  firstseenat: 1548311506
                  disposition: clean
                  score: 10
                  hostname: google.com
                  malwarename: malware
                  sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-identities:
    get:
      tags:
        - Top Identities
      summary: Top Identities (all)
      description: |-
        List identities in descending order. Order by the number of requests sent to Umbrella.
      operationId: getTopIdentities
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIdentity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - requests: 3827
                  bandwidth: 7051943359
                  identity:
                    id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  rank: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-identities/{type}:
    get:
      tags:
        - Top Identities
      summary: Top Identities by Type
      description: |-
        List identities in descending order.
        Order by the number of requests sent to Umbrella.
      operationId: getTopIdentitiesType
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIdentity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - requests: 3827
                  bandwidth: 7051943359
                  identity:
                    id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  rank: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/identity-distribution:
    get:
      tags:
        - Identity Distribution
      summary: Identity Distribution (all)
      description: List number of requests by identity types.
      operationId: getIdentityDistribution
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/IdentityDistribution'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  requests: 312
                  unique_identity_count: 12
                  identitytype:
                    id: 21
                    label: Sites
                    type: site
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/identity-distribution/{type}:
    get:
      tags:
        - Identity Distribution
      summary: Identity Distribution by Type
      description: List number of requests by identity types for the traffic type.
      operationId: getIdentityDistributionType
      parameters:
        - $ref: '#/components/parameters/typeDnsWebParam'
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/IdentityDistribution'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  requests: 312
                  unique_identity_count: 12
                  identitytype:
                    id: 21
                    label: Sites
                    type: site
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-destinations:
    get:
      tags:
        - Top Destinations
      summary: Top Destinations
      description: List destinations ordered by the number of requests made in descending order.
      operationId: getTopDestinations
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - bandwidth: 223437
                    rank: 4
                    domain: google.com
                    count: 3827
                    counts:
                      requests: 123
                      allowedrequests: 60
                      blockedrequests: 63
                    categories:
                      - id: 66
                        label: Malware
                        type: security
                        integration: true
                    policycategories:
                      - id: 66
                        label: Malware
                        type: security
                        integration: true
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-destinations/{type}:
    get:
      tags:
        - Top Destinations
      summary: Top Destinations
      description: |-
        List destinations ordered by the number of requests made
        in descending order.
      operationId: getTopDestinationsType
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - bandwidth: 223437
                  rank: 4
                  domain: google.com
                  count: 3827
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  categories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  policycategories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-urls:
    get:
      tags:
        - Top Destinations
      summary: Top URLs
      description: Returns a list of top-N URLs proxied for a given domain.
      operationId: getTopUrls
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopURL'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  path: ""
                  categories:
                    - id: 66
                      label: Malware
                      type: security
                      integration: true
                  rank: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-categories:
    get:
      tags:
        - Top Categories
      summary: Top Categories (all)
      description: |-
        List categories ordered by the number of requests made
        matching the categories in descending order.
      operationId: getTopCategories
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - rank: 5
                  category:
                    id: 66
                    label: Malware
                    typse: security
                    integration: true
                  count: 3827
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-categories/{type}:
    get:
      tags:
        - Top Categories
      summary: Top Categories
      description: List categories ordered by the number of requests made
        matching the categories in descending order.
      operationId: getTopCategoriesType
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpParam'
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - rank: 5
                  category:
                    id: 66
                    label: Malware
                    type: security
                    integration: true
                  count: 3827
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-eventtypes:
    get:
      tags:
        - Top Event Types
      summary: Top Event Types (all)
      description: |-
        List event types ordered by the number of requests made
        for each type of event in descending order. The event types are: "domain_security",
        "domain_integration", "url_security", "url_integration", "cisco_amp" and "antivirus".
      operationId: getTopEventTypes
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopEventType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - eventtype: antivirus
                  count: 3827
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-dns-query-types:
    get:
      tags:
        - Top DNS query types
      summary: Top DNS Query Types
      operationId: getTopDNSQueryTypes
      description: List the top DNS query types.
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/orderParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopDnsQueryType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - requests: 123
                  querytype: A
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/requests-by-hour:
    get:
      tags:
        - Organization Requests by Hour
      summary: Requests by Hour (ALL)
      description: List activity volume within timeframe.
      operationId: getRequestsByHour
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: "2019"
                  time: 16:00:00
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/requests-by-hour/{type}:
    get:
      tags:
        - Organization Requests by Hour
      summary: Requests by Hour
      description: List activity volume within timeframe.
      operationId: getOrganizationRequestsByHour
      parameters:
        - $ref: '#/components/parameters/typeAllParam'
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: "2019"
                  time: 16:00:00
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/requests-by-timerange:
    get:
      tags:
        - Organization Requests by Timerange
      summary: Requests by Timerange (ALL)
      description: List activity volume within timeframe.
      operationId: getRequestsByTimerange
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/xTrafficTypeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/MspRequestsByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: "2019"
                  time: 16:00:00
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/requests-by-timerange/{type}:
    get:
      tags:
        - Organization Requests by Timerange
      summary: Requests by Timerange
      description: List activity volume within timeframe.
      operationId: getRequestsByTimerangeType
      parameters:
        - $ref: '#/components/parameters/typeAllParam'
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: "2019"
                  time: 16:00:00
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/categories-by-hour:
    get:
      tags:
        - Organization Requests by Hour and Category
      summary: Requests by Hour and Category (ALL)
      description: List activity volume within timeframe, separate by categories.
      operationId: getRequestsByHourAndCategory
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: "2019"
                  time: 16:00:00
                  counts:
                    - category:
                        id: 66
                        label: Malware
                        type: security
                        integration: true
                      requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/categories-by-hour/{type}:
    get:
      tags:
        - Organization Requests by Hour and Category
      summary: Requests by Hour and Category
      description: List activity volume within timeframe, separate by categories.
      operationId: getRequestsByHourAndCategoryAndType
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/typeDnsWebIpParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: "2019"
                  time: 16:00:00
                  counts:
                    - category:
                        id: 66
                        label: Malware
                        type: security
                        integration: true
                      requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/categories-by-timerange:
    get:
      tags:
        - Organization Requests by Timerange and Category
      summary: Requests by Timerange and Category (ALL)
      description: List activity volume within timeframe, separate by categories.
      operationId: getRequestsByTimerangeAndCategory
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: "2019"
                  time: 16:00:00
                  counts:
                    - category:
                        id: 66
                        label: Malware
                        type: security
                        integration: true
                      requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/categories-by-timerange/{type}:
    get:
      tags:
        - Organization Requests by Timerange and Category
      summary: Requests by Timerange and Category
      description: List activity volume within timeframe breakdown by categories.
      operationId: getRequestsByTimerangeAndCategoryType
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/typeDnsWebIpParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: "2019"
                  time: 16:00:00
                  counts:
                    - category:
                        id: 66
                        label: Malware
                        type: security
                        integration: true
                      requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/deployment-status:
    get:
      tags:
        - Deployment Status
      summary: Deployment Status
      description: List deployment status within timeframe.
      operationId: getDeploymentStatus
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/DeploymentStatus'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - id: 21
                  label: Sites
                  type:
                    id: 1
                    label: Sites
                    type: Sites
                  activecount: 1
                  count: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/{msporganizationid}/deployments:
    get:
      tags:
        - MSP Deployment Status
      summary: Deployment Status by Organization
      description: List summary counts of Deployment Status by Organization within
        timeframe.
      operationId: getDeploymentStatusByOrganization
      parameters:
        - $ref: '#/components/parameters/mspOrganizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/OrganizationDeploymentStatus'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - organization:
                    id: 232323
                    label: Company Name Goes Here
                  counts:
                    - identitytype:
                        id: 21
                        label: Sites
                        type: site
                      activecount: 1
                      count: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/{msporganizationid}/requests-by-hour:
    get:
      tags:
        - MSP Requests by Hour
      summary: MSP Requests by Hour (ALL)
      description: List activity volume within timeframe.
      operationId: getMspRequestsByHour
      parameters:
        - $ref: '#/components/parameters/mspOrganizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/MspRequestsByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: "2019"
                  time: 16:00:00
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/{msporganizationid}/requests-by-timerange:
    get:
      tags:
        - MSP Requests by Timerange
      summary: MSP Requests by Timerange (ALL)
      description: List activity volume within timeframe.
      operationId: getMspRequestsByTimerange
      parameters:
        - $ref: '#/components/parameters/mspOrganizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/MspRequestsByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: "2019"
                  time: 16:00:00
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/{msporganizationid}/requests-by-org:
    get:
      tags:
        - MSP Requests by Organization
      summary: MSP Requests by Organization
      description: List summary counts of all requests within timeframe.
      operationId: getMspRequestsByOrganization
      parameters:
        - $ref: '#/components/parameters/mspOrganizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyOrganization'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - organization:
                      id: 232323
                      label: Company Name Goes Here
                    counts:
                      total: 1
                      totalblocked: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/{msporganizationid}/requests-by-category:
    get:
      tags:
        - MSP Requests by Category
      summary: MSP Requests by Category
      description: List summary counts of all requests within timeframe.
      operationId: getMspRequestsByCategory
      parameters:
        - $ref: '#/components/parameters/mspOrganizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    counts:
                      total: 1
                      totalblocked: 1
                      numberoforganizationsaffected: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/{msporganizationid}/requests-by-destination:
    get:
      tags:
        - MSP Requests by Destination
      summary: MSP Requests by Destination
      description: List summary counts of all requests within timeframe.
      operationId: getMspRequestsByDestination
      parameters:
        - $ref: '#/components/parameters/mspOrganizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/MspRequestsbyDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - domain: ""
                    categories:
                      - id: 66
                        label: Malware
                        type: security
                        integration: true
                    counts:
                      total: 1
                      totalblocked: 1
                      numberoforganizationsaffected: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/{msporganizationid}/category-requests-by-org:
    get:
      tags:
        - MSP Category Requests by Organization
      summary: MSP Category Requests by Organization
      description: List summary counts of all requests for each category per organization
        within the timeframe.
      operationId: getMspCategoryRequestsByOrganization
      parameters:
        - $ref: '#/components/parameters/mspOrganizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/MspCategoryRequestsByOrganization'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - organization:
                      id: 232323
                      label: Company Name Goes Here
                    counts:
                      - category:
                          id: 66
                          label: Malware
                          type: security
                          integration: true
                        requests: 123
                        requestsblocked: 34
                        numberoforganizationswithcategorizedtraffic: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/bandwidth-by-hour:
    get:
      tags:
        - Bandwidth by Hour
      summary: Bandwidth by Hour (All)
      description: List bandwidth in bytes within timeframe. Only returns proxy data.
      operationId: getBandwidthByHour
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/BandwidthbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - inboundbytes: 123
                    outboundbytes: 456
                    timestamp: 1559836800000
                    date: "2019"
                    time: 16:00:00
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/bandwidth-by-timerange:
    get:
      tags:
        - Bandwidth by Timerange
      summary: Bandwidth by Timerange (All)
      description: List bandwidth in bytes within timeframe. Only returns proxy data.
      operationId: getBandwidthByTimerange
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/timerangeParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/BandwidthbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - inboundbytes: 123
                    outboundbytes: 456
                    timestamp: 1559836800000
                    date: "2019"
                    time: 16:00:00
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-files:
    get:
      tags:
        - Top Files
      summary: Top Files (Proxy)
      description: List top files within timeframe. Only returns proxy data.
      operationId: getTopFilesProxy
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopFile'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - requests: 123
                  sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
                  categories:
                    - id: 66
                      label: Malware
                      type: security
                      integration: true
                  identitycount: 1
                  filenames: []
                  filetypes: []
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/total-requests:
    get:
      tags:
        - Total Requests
      summary: Total Requests (All)
      description: Returns a count of total requests for the given filters.
      operationId: getTotalRequests
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/sha256Param'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/TotalRequest'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/total-requests/{type}:
    get:
      tags:
        - Total Requests
      summary: Total Requests (By Type)
      description: Returns a count of total requests for the given filters.
      operationId: getTotalRequestsByType
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/TotalRequest'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-threats:
    get:
      tags:
        - Top Threats
      summary: Top Threats (All)
      description: List top threats within timeframe. Returns both DNS and Proxy data.
      operationId: getTopThreats
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreats'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - threat: Wannacry
                  threattype: Ransomware
                  count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-threats/{type}:
    get:
      tags:
        - Top Threats
      summary: Top Threats (By Type)
      description: List top threats within timeframe for the given filters.
      operationId: getTopThreatsByType
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/typeDnsWebParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreats'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - threat: Wannacry
                  threattype: Ransomware
                  count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-threat-types:
    get:
      tags:
        - Top Threat Types
      summary: Top Threat Types (All)
      description: List top threat-types within timeframe. Returns both DNS and Proxy
        data.
      operationId: getTopThreatTypes
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreatTypes'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - threattype: Ransomware
                    threatscount: 10
                    count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-threat-types/{type}:
    get:
      tags:
        - Top Threat Types
      summary: Top Threat Types (By Type)
      description: List top threat-types within timeframe for the given filters.
      operationId: getTopThreatTypesByType
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/typeDnsWebParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreatTypes'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - threattype: Ransomware
                    threatscount: 10
                    count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/applications:
    get:
      tags:
        - Utility
      summary: List Applications
      operationId: getApplications
      description: List applications.
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/applicationNameParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ApplicationsWithCategories'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  applications:
                    - id: 1
                      label: "Web Hosting"
                      type: "AVC"
                      category:
                        id: 40
                        label: "Hosting Services"
                  categories:
                    - id: 42
                      name: "Education"
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/categories:
    get:
      tags:
        - Utility
      summary: List Categories
      description: List categories.
      operationId: getCategories
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryWithLegacyId'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - id: 66
                    legacyid: 94
                    label: Malware
                    type: security
                    integration: true
                    deprecated: true
                  - id: 110
                    legacyid: 176
                    label: DNS Tunneling VPN
                    type: security
                    integration: true
                    deprecated: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /providers/{msporganizationid}/categories:
    get:
      tags:
        - Utility
      summary: List MSP Categories
      description: List MSP categories.
      operationId: getMspCategories
      parameters:
        - $ref: '#/components/parameters/mspOrganizationIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryWithLegacyId'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - id: 66
                    legacyid: 94
                    label: Malware
                    type: security
                    integration: true
                    deprecated: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/identities:
    get:
      tags:
        - Utility
      summary: List Identities
      operationId: getIdentities
      description: List identities.
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/searchParam'
        - $ref: '#/components/parameters/identityTypesParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Identity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
    post:
      tags:
        - Utility
      summary: List Identities by ID
      description: |-
        Query for list of identities by their ID.
      operationId: createIdentities
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/limitParam'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                identityids:
                  type: array
                  items:
                    type: integer
                    example: 234567891
            example:
              identityids: [234567891, 234567892]
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Identity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/identities/{identityid}:
    get:
      tags:
        - Utility
      summary: Get Identity
      description: List identity by identity ID.
      operationId: getIdentity
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/identityIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Identity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  id: 1
                  label: Catch Rate Testing System
                  type:
                    id: 21
                    label: Sites
                    type: site
                  deleted: true
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/threat-types:
    get:
      tags:
        - Utility
      summary: List Threat Types
      description: List threat types.
      operationId: getThreatTypes
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ThreatType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - name: Ransomware
                  description: a description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/threat-types/{threattypeid}:
    get:
      tags:
        - Utility
      summary: Get Threat Type
      description: List threat types by threat ID.
      operationId: getThreatType
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/threatTypeIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ThreatType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                    name: Ransomware
                    description: a description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/threat-names:
    get:
      tags:
        - Utility
      summary: List Threat Names
      description: List the threat names.
      operationId: getThreatNames
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ThreatName'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - name: WannaCry
                  description: a description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/threat-names/{threatnameid}:
    get:
      tags:
        - Utility
      summary: Get Threat Name
      description: Get the threat name by thread ID.
      operationId: getThreatName
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/threatNameIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ThreatName'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  name: WannaCry
                  description: WannaCry threat description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-ips:
    get:
      tags:
        - Top IPs
      summary: List Top IPs
      description: List the top IPs.
      operationId: getTopIps
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIP'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                 - ip: 10.0.0.1
                   count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/top-ips/internal:
    get:
      tags:
        - Top IPs
      summary: List Top IPs Internal
      description: List the top IPs internal.
      operationId: getTopIpsInternal
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIP'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                - ip: 10.0.0.1
                  count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /organizations/{organizationid}/summary:
    get:
      tags:
        - Summary
      summary: Get Summary (All)
      description: Get the summary.
      operationId: getSummary
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Summary'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  applications: 123
                  domains: 82
                  requestsblocked: 189
                  filetypes: 0
                  policycategories: 2
                  policyrequests: 2
                  requests: 189
                  requestsallowed: 10
                  categories: 11
                  identitytypes: 1
                  applicationsblocked: 2
                  files: 5
                  identities: 1
                  applicationsallowed: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/summary/{type}:
    get:
      tags:
        - Summary
      summary: Get Summary by Type
      description: List the summary by type.
      operationId: getSummaryType
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Summary'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  applications: 123
                  domains: 82
                  requestsblocked: 189
                  filetypes: 0
                  policycategories: 2
                  requests: 189
                  requestsallowed: 10
                  categories: 11
                  identitytypes: 1
                  applicationsblocked: 2
                  files: 5
                  identities: 1
                  applicationsallowed: 2
                  policyrequests: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/summaries-by-category:
    get:
      tags:
        - Summaries by Category
      summary: Get Summaries by category (All)
      description: List the summaries by category.
      operationId: getSummariesByCategory
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    summary:
                      applications: 123
                      domains: 82
                      requestsblocked: 189
                      filetypes: 0
                      policycategories: 2
                      requests: 189
                      requestsallowed: 10
                      categories: 11
                      identitytypes: 1
                      applicationsblocked: 2
                      files: 5
                      identities: 1
                      applicationsallowed: 2
                      policyrequests: 6
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/summaries-by-category/{type}:
    get:
      tags:
        - Summaries by Category
      summary: Get Summaries by category
      description: Get summaries by category for the type.
      operationId: getSummariesByCategoryType
      parameters:
        - $ref: '#/components/parameters/typeDnsWebIpParam'
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    summary:
                      applications: 123
                      domains: 82
                      requestsblocked: 189
                      filetypes: 0
                      policycategories: 2
                      requests: 189
                      requestsallowed: 10
                      categories: 11
                      identitytypes: 1
                      applicationsblocked: 2
                      files: 5
                      identities: 1
                      applicationsallowed: 2
                      policyrequests: 4
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/summaries-by-destination:
    get:
      tags:
        - Summaries by Destination
      summary: Get Summaries by destination (All)
      description: List summaries by destination.
      operationId: getSummariesByDestination
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - domain: www.google.com
                    summary:
                      applications: 123
                      domains: 82
                      requestsblocked: 189
                      filetypes: 0
                      policycategories: 2
                      policyrequests: 2
                      requests: 189
                      requestsallowed: 10
                      categories: 11
                      identitytypes: 1
                      applicationsblocked: 2
                      files: 5
                      identities: 1
                      applicationsallowed: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /organizations/{organizationid}/summaries-by-destination/{type}:
    get:
      tags:
        - Summaries by Destination
      summary: Get Summaries by destination
      description: List summaries by destination for the type.
      operationId: getSummariesByDestinationType
      parameters:
        - $ref: '#/components/parameters/typeDnsWebParam'
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/domainsParam'
        - $ref: '#/components/parameters/urlsParam'
        - $ref: '#/components/parameters/categoriesParam'
        - $ref: '#/components/parameters/policyCategoriesParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/applicationIdParam'
        - $ref: '#/components/parameters/verdictParam'
        - $ref: '#/components/parameters/ruleIdParam'
        - $ref: '#/components/parameters/filenameParam'
        - $ref: '#/components/parameters/securityOverriddenParam'
        - $ref: '#/components/parameters/bundleIdParam'
        - $ref: '#/components/parameters/threatsParam'
        - $ref: '#/components/parameters/threatTypesParam'
        - $ref: '#/components/parameters/ampDispositionParam'
        - $ref: '#/components/parameters/antivirusThreatsParam'
        - $ref: '#/components/parameters/dataLossPreventionStateParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - domain: www.google.com
                    summary:
                      applications: 123
                      domains: 82
                      requestsblocked: 189
                      filetypes: 0
                      policycategories: 2
                      policyrequests: 2
                      requests: 189
                      requestsallowed: 10
                      categories: 11
                      identitytypes: 1
                      applicationsblocked: 2
                      files: 5
                      identities: 1
                      applicationsallowed: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'

  /organizations/{organizationid}/summaries-by-rule/intrusion:
    get:
      tags:
        - Summaries by Rule (Intrusion)
      summary: Get Summaries by rule
      description: List summaries by rule for Intrusion type.
      operationId: getSummariesByRuleIntrusion
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/offsetParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/signaturesParam'
        - $ref: '#/components/parameters/signatureListIdsParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/intrusionActionParam'
        - $ref: '#/components/parameters/portsParam'
        - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SignatureListSummary'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - signaturelist:
                      id: 1111
                    signatures:
                      - counts:
                          blocked: 0
                          detected: 1
                          wouldblock: 0
                        generatorid: 1
                        lasteventat: 1594557262000
                        id: 47829
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'


# remote access
  /organizations/{organizationid}/remote-access-events:
    get:
      tags:
        - Remote Access
      summary: Get Remote Access Events
      description: List the events logged by remote access.
      operationId: getRemoteAccessEvents
      parameters:
        - $ref: '#/components/parameters/organizationIdParam'
        - $ref: '#/components/parameters/fromParam'
        - $ref: '#/components/parameters/toParam'
        - $ref: '#/components/parameters/limitParam'
        - $ref: '#/components/parameters/ipParam'
        - $ref: '#/components/parameters/identityIdsParam'
        - $ref: '#/components/parameters/identityTypesParam'
        - $ref: '#/components/parameters/connectioneventParam'
        - $ref: '#/components/parameters/anyconnectversionsParam'
        - $ref: '#/components/parameters/osversionsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RemoteAccess'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
              example:
                data:
                  - osversion: linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)
                    internalip: 10.0.1.5
                    connecttimestamp: 1667252442
                    reason: ACCT_DISC_USER_REQ
                    failedreasons: []
                    connectionevent: disconnected
                    anyconnectversion: 4.10.05095
                    timestamp: 1667252458
                    identities:
                      - id: 1173502975
                        type:
                          id: 7
                          type: directory_user
                          label: AD Users
                        label: sample-remote-access@cisco.com
                        deleted: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'


security:
  - oauthFlow: []
components:
  parameters:
    organizationIdParam:
      name: organizationid
      in: path
      description: The organization ID
      required: true
      schema:
        type: number
      example: 1234567
    fromParam:
      name: from
      in: query
      description: |-
        A timestamp or relative time string (for example: '-1days').
        Filter for data that appears after this time.
      required: true
      schema:
        type: string
      example: "1639146300000"
    toParam:
      name: to
      in: query
      description: |-
        A timestamp or relative time string (for example: 'now').
        Filter for data that appears before this time.
      required: true
      schema:
        type: string
      example: "1640010300000"
    offsetParam:
      name: offset
      in: query
      description:
        A number that represents an index into the collection.
      schema:
        type: number
      example: 0
    limitParam:
      name: limit
      in: query
      description:
        The maximum number of records to return from the collection.
      required: true
      schema:
        type: number
      example: 100
    domainsParam:
      name: domains
      in: query
      description:
        A domain name or comma-delimited list of domain name.
      schema:
        type: string
      example: "google.com,facebook.com"
    urlsParam:
      name: urls
      in: query
      description: A URL or comma-delimited list of URL.
      schema:
        type: string
      example: "https://google.com,facebook.com/help"
    categoriesParam:
      name: categories
      in: query
      description: A category ID or comma-delimited list of category ID.
      schema:
        type: string
      example: "148,151,66"
    policyCategoriesParam:
      name: policycategories
      in: query
      description: |-
        A category ID or comma-delimited list of category ID.
        Filter request by the categories that trigger a policy.
      schema:
        type: string
      example: "67,69"
    ipParam:
      name: ip
      in: query
      description: An IP address
      schema:
        type: string
      example: "10.10.10.10"
    orderParam:
      name: order
      in: query
      description: |-
        A string that describes how to order the results
        (for example: 'asc' or 'desc').
      schema:
        type: string
      example: desc
    portsParam:
      name: ports
      in: query
      description: A port number or comma-delimited list of port number.
      schema:
        type: string
      example: "7351,80"
    identityIdsParam:
      name: identityids
      in: query
      description: An identity ID or comma-delimited list of identity ID.
      schema:
        type: string
      example: "1,2,3"
    identityTypesParam:
      name: identitytypes
      in: query
      description: An identity type or comma-delimited list of identity type.
      schema:
        type: string
      example: network,roaming
    applicationIdParam:
      name: applicationid
      in: query
      description: An application ID.
      schema:
        type: string
      example: "1"
    verdictParam:
      name: verdict
      in: query
      description: A verdict string or comma-delimited list of verdict string.
      schema:
        type: string
      example: allowed,blocked,proxied
    ruleIdParam:
      name: ruleid
      in: query
      description: A firewall policy rule ID.
      schema:
        type: number
      example: 1
    filenameParam:
      name: filename
      in: query
      description: |-
        A string that identifies a filename. Filter request by the filename.
        Supports globbing or use of the wildcard character ('*'). The asterisk (*) matches
        zero or more occurrences of any character.
      schema:
        type: string
      example: "myfilename_*"
    securityOverriddenParam:
      name: securityoverridden
      in: query
      description: Specify whether to filter on requests that override security.
      schema:
        type: boolean
      example: true
    bundleIdParam:
      name: bundleid
      in: query
      description: A proxy bundle ID.
      schema:
        type: number
      example: 1
    threatsParam:
      name: threats
      in: query
      description: A threat name or comma-delimited list of threat name.
      schema:
        type: string
    threatTypesParam:
      name: threattypes
      in: query
      description: A threat type or comma-delimited list of threat type.
      schema:
        type: string
    ampDispositionParam:
      name: ampdisposition
      in: query
      description: |-
        An AMP disposition string or a comma-delimited list of AMP disposition string.
      schema:
        type: string
      example: clean,malicious,unknown
    isolatedStateParam:
      name: isolatedstate
      in: query
      description: |-
        A string that describes the remote browser isolation
        (RBI) isolation type (for example: 'isolated' or 'not-isolated').
      schema:
        type: string
        enum: [isolated, not-isolated]
      example: isolated
    isolatedFileActionParam:
      name: isolatedFileAction
      in: query
      description: |-
        A string that describes the remote browser isolation (RBI) file action type
        (for example: 'viewed', 'downloaded-original-file', or 'downloaded-safe-pdf').
      schema:
        type: string
        enum: [viewed, downloaded-original-file, downloaded-safe-pdf]
      example: downloaded-safe-pdf
    dataLossPreventionStateParam:
      name: datalosspreventionstate
      in: query
      description: |-
        A string that describes the status of a destination (for example: 'blocked').
        Filter data for requests that were blocked to protect data.
      schema:
        type: string
      example: blocked
    sha256Param:
      name: sha256
      in: query
      description: A SHA-256 hash
      schema:
        type: string
      example: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
    antivirusThreatsParam:
      name: antivirusthreats
      in: query
      description:
        "A threat name or comma-delimited list of threat name."
      schema:
        type: string
      example: Trojan.Linux.Generic.144075
    xTrafficTypeParam:
      name: x-traffic-type
      in: header
      description: |-
        A string or comma-delimited list of string that describes the type of traffic. Valid values:
        dns, proxy, firewall, or ip. If the header is not set, the default value is 'all'.
      schema:
        type: string
      example: "dns,proxy,firewall,ip"
    tenantControlsParam:
      name: tenantcontrols
      in: query
      description: If set to 'true', filter data for requests that are part of a tenant control policy.
      schema:
        type: boolean
      example: true
    typeDnsWebParam:
      name: type
      in: path
      description: |-
        Specify the type of traffic. Valid values: dns or proxy
      required: true
      schema:
        type: string
      example: dns
    typeDnsWebIpParam:
      name: type
      in: path
      description: |-
        Specify the type of traffic. Valid values: dns, proxy, or ip
      required: true
      schema:
        type: string
      example: ip
    typeDnsWebIpFirewallParam:
      name: type
      in: path
      description: |-
        Specify the type of traffic. Valid values: dns, proxy, firewall, or ip
      required: true
      schema:
        type: string
      example: firewall
    typeAllParam:
      name: type
      in: path
      description: |-
        Specify the type of traffic. Valid values: dns, proxy, firewall, intrusion, or ip
      required: true
      schema:
        type: string
      example: intrusion
    identityIdParam:
      name: identityid
      in: path
      description: An identity ID
      required: true
      schema:
        type: number
      example: 42
    threatTypeIdParam:
      name: threattypeid
      in: path
      description: A threat type name
      required: true
      schema:
        type: string
      example: Ransomware
    searchParam:
      name: search
      in: query
      description: |-
        A string that represents a search parameter.
        Filter data for requests in which the search string appears in the endpoint data.
      schema:
        type: string
      example: somelabel
    threatNameIdParam:
      name: threatnameid
      in: path
      description: The threat name
      required: true
      schema:
        type: string
      example: WannaCry
    timerangeParam:
      name: timerange
      in: header
      description: |-
        A string that represents a range of time (for example: 'minute', 'hour', or 'day').
        If the header is not set, the header value defaults to 'hour'.
      schema:
        type: string
      example: minute
    mspOrganizationIdParam:
      name: msporganizationid
      in: path
      description: the provider organization id (multiple orgs can live under a
        provider)
      required: true
      schema:
        type: number
      example: 1
    applicationNameParam:
      name: application
      in: query
      description: The application name
      schema:
        type: string
      example: Games
    filterNoisyDomainsParam:
      name: filternoisydomains
      in: query
      description: filter out domains that generate a lot of insignificant traffic (noise).
      schema:
        type: boolean
      example: true
    httpErrorsParam:
      name: httperrors
      in: query
      description: filter data for requests that resulted in a TLS error or a certificate error
      schema:
        type: string
        enum: [certificateerror, tlserror]
      example: certificateerror
    signaturesParam:
      name: signatures
      in: query
      description: list of <signatureid>-<generatorid>, comma delimited
      schema:
        type: string
      example: '1-2,1-4'
    signatureListIdsParam:
      name: signaturelistids
      in: query
      description: list of signature list ids, comma delimited
      schema:
        type: string
      example: '1,2'
    intrusionActionParam:
      name: intrusionaction
      in: query
      description: "list of intrusion actions, comma delimited. possible values: would_block, blocked, detected"
      schema:
        type: string
      example: detected,would_block
    existsParam:
      name: exists
      in: query
      description: |-
        Specify a comma-separated list of attributes to filter the data. Valid values are: categories, policycategories, applicationid,
        nbarapplicationid, nbarapplicationtypeids, privateapplicationid, applicationgroupids, sha256, filename, threats, threattypes,
        antivirusthreats, destinationlistids, httperrors.
      schema:
        type: string
      example: destinationlistids,threattypes
    connectioneventParam:
      name: connectionevent
      in: query
      description: Specify the type of connection event.
      schema:
        type: string
        enum: [connected, disconnected, failed]
      example: connected
    osversionsParam:
      name: osversions
      in: query
      description: Specify a comma-separated list of OS versions to filter the data.
      schema:
        type: string
      example: ''
    anyconnectversionsParam:
      name: anyconnectversions
      in: query
      description: |-
        Specify a comma-separated list of AnyConnect Roaming Security module
        versions to filter the data.
      schema:
        type: string
      example: '4.10.05095'

  schemas:
    ActivityProxy:
      type: object
      properties:
        externalip:
          type: string
          description: external IP for entry
        internalip:
          type: string
          description: internal IP for entry
        policycategories:
          type: array
          description: array of policy categories
          items:
            $ref: '#/components/schemas/Category'
        categories:
          type: array
          description: array of categories
          items:
            $ref: '#/components/schemas/Category'
        verdict:
          type: string
          description: verdict for entry
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        identities:
          type: array
          description: array of identities for entry
          items:
            $ref: "#/components/schemas/Identity"
        allapplications:
          type: array
          description: array of applications for entry
          items:
            $ref: "#/components/schemas/Application"
        allowedapplications:
          type: array
          description: array of allowed applications for entry
          items:
            $ref: "#/components/schemas/Application"
        blockedapplications:
          type: array
          description: array of blocked applications for entry
          items:
            $ref: "#/components/schemas/Application"
        responsefilename:
          type: string
          description: response filename for entry
        blockedfiletype:
          type: string
          description: blocked file type for entry
        bundleid:
          type: number
          description: bundleid
        amp:
          $ref: '#/components/schemas/CiscoAMP'
        type:
          type: string
          description: type of the request. A proxy request always has type proxy
        tenantcontrols:
          type: boolean
          description: if the request was part of a tenant control policy
        port:
          type: number
          description: request port
          nullable: true
        antivirusthreats:
          $ref: '#/components/schemas/AntivirusThreats'
        policy:
          $ref: '#/components/schemas/Policy'
        requestmethod:
          type: string
          description: The HTTP request method that was made.
          example: GET
        responsesize:
          type: number
          description: Response size in bytes.
        requestsize:
          type: number
          description: Request size in bytes.
        statuscode:
          type: number
          description: The HTTP status code; should always be 200 or 201.
          example: 200
        useragent:
          type: string
          description: The browser agent that made the request.
        referer:
          type: string
          description: The referring domain or URL.
        warnstatus:
          type: string
        sha256:
          type: string
          description: The hex digest of the response content.
        isolated:
          $ref: '#/components/schemas/Isolated'
        datalossprevention:
          $ref: '#/components/schemas/DataLossPreventionState'
        securityoverridden:
          type: boolean
        contenttype:
          type: string
          description: The type of web content, typically text/html.
          example: text/html
        forwardingmethod:
          type: string
          description: The request method (GET, POST, HEAD, etc.)
          example: GET
        httperrors:
          type: array
          items:
            $ref: "#/components/schemas/HttpError"
          description: Certificate & TLS Errors
        threats:
          type: array
          items:
            $ref: "#/components/schemas/Threat"
        egress:
          $ref: '#/components/schemas/Egress'
        datacenter:
          $ref: '#/components/schemas/DataCenter'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
        destinationip:
          $ref: '#/components/schemas/DestinationIp'
        url:
          type: string
          description: The URL requested
      required:
        - allapplications
        - allowedapplications
        - amp
        - antivirusthreats
        - blockedapplications
        - blockedfiletype
        - bundleid
        - categories
        - contenttype
        - datacenter
        - datalossprevention
        - date
        - destinationip
        - egress
        - externalip
        - forwardingmethod
        - httperrors
        - identities
        - internalip
        - isolated
        - policy
        - policycategories
        - port
        - referer
        - requestsize
        - responsefilename
        - responsesize
        - securityoverridden
        - sha256
        - statuscode
        - tenantcontrols
        - threats
        - time
        - timestamp
        - type
        - url
        - useragent
        - verdict
        - warnstatus
      example:
        destinationip: ''
        externalip: 32.4.91.7
        responsesize: 3329530
        allapplications:
          - id: 1313
            label: Netflix
            category:
              id: 47
              label: Media
        date: '2022-02-18'
        datalossprevention:
          state: ''
        antivirusthreats:
          puas: []
          viruses: []
          others: []
        internalip: 192.168.1.43
        referer: ''
        contenttype: ''
        tenantcontrols: false
        securityoverridden: false
        useragent: ''
        time: '23:29:42'
        amp:
          disposition: ''
          score: 0
          malware: ''
        policycategories: []
        type: proxy
        requestsize: 1996
        port: 443
        policy:
          ruleid: 0
          rulesetid: 0
          destinationlistids: []
          timebasedrule: false
        forwardingmethod: ''
        categories:
          - id: 17
            type: content
            label: Movies
            integration: false
            deprecated: true
        isolated:
          state: not-isolated
          fileaction: ''
        statuscode: 200
        egress:
          ip: 155.190.3.8
          type: shared
        blockedfiletype: ''
        url: https://ipv4-lax2-ix.1.oca.anothervideo.net
        verdict: allowed
        responsefilename: ''
        warnstatus: ''
        sha256: ''
        timestamp: 1645226982000
        blockedapplications: []
        allowedapplications: []
        identities:
          - id: 1
            type:
              id: 34
              type: anyconnect
              label: Anyconnect Roaming Client
            label: Vincent's Macbook
            deleted: false
        datacenter:
          label: Atlanta, US
          id: ATL
        threats: []
        httperrors: []
        bundleid: 3
    ActivityFirewall:
      type: object
      properties:
        date:
          $ref: '#/components/schemas/Date'
        destinationip:
          $ref: '#/components/schemas/DestinationIp'
        sourceip:
          $ref: '#/components/schemas/SourceIp'
        sourceport:
          $ref: '#/components/schemas/SourcePort'
        destinationport:
          $ref: '#/components/schemas/DestinationPort'
        verdict:
          type: string
          description: verdict for entry
        time:
          $ref: '#/components/schemas/Time'
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        identities:
          type: array
          description: array of identities for entry
          items:
            $ref: "#/components/schemas/Identity"
        protocol:
          $ref: '#/components/schemas/Protocol'
        rule:
          $ref: '#/components/schemas/Rule'
        type:
          type: string
          description: type of the request. a firewall request always has type firewall
        allapplications:
          type: array
          description: a list of firewall applications
          items:
            $ref: "#/components/schemas/FirewallApplication"
        applicationprotocols:
          type: array
          description: a list of firewall applications
          items:
            $ref: "#/components/schemas/FirewallApplication"
        direction:
          type: string
          description: The direction of the packet. It is destined either towards the internet or to the customer's network.
        packetsize:
          type: number
          description: The size of the packet that Umbrella CDFW received.
      required:
        - allapplications
        - applicationprotocols
        - date
        - destinationip
        - destinationport
        - direction
        - identities
        - packetsize
        - protocol
        - rule
        - sourceip
        - sourceport
        - time
        - timestamp
        - type
        - verdict
      example:
        date: ""
        destinationip: 52.8.160.247
        sourceip: 192.168.0.1
        sourceport: 0
        destinationport: 0
        direction: toward
        verdict: allowed
        time: 12:34
        timestamp: 1548311506
        packetsize: 32
        identities:
          - id: 1
            label: Catch Rate Testing System
            type:
              id: 21
              label: Sites
              type: site
            deleted: false
        protocol:
          id: 17
          label: UDP
        rule:
          id: 1
          label: Default Rule
        type: firewall
        allapplications:
          - id: 72
            label: 'dns IT Service Management'
            app: ""
        applicationprotocols:
          - id: 72
            label: 'dns IT Service Management'
            app: ""
    ActivityIntrusion:
      type: object
      properties:
        classification:
          $ref: '#/components/schemas/Classification'
        date:
          $ref: '#/components/schemas/Date'
        destinationip:
          $ref: '#/components/schemas/DestinationIp'
        destinationport:
          $ref: '#/components/schemas/DestinationPort'
        identities:
          type: array
          description: array of identities for entry
          items:
            $ref: "#/components/schemas/Identity"
        protocol:
          $ref: '#/components/schemas/Protocol'
        sessionid:
          $ref: '#/components/schemas/SessionId'
        severity:
          $ref: '#/components/schemas/Severity'
        signature:
          $ref: '#/components/schemas/Signature'
        signaturelist:
          $ref: '#/components/schemas/SignatureList'
        sourceip:
          $ref: '#/components/schemas/SourceIp'
        sourceport:
          $ref: '#/components/schemas/SourcePort'
        time:
          $ref: '#/components/schemas/Time'
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        type:
          type: string
          description: type of the request. an intrusion request always has type intrusion
        verdict:
          type: string
          description: verdict for entry
      required:
        - classification
        - date
        - destinationip
        - destinationport
        - identities
        - protocol
        - sessionid
        - severity
        - signature
        - signaturelist
        - sourceip
        - sourceport
        - time
        - timestamp
        - type
        - verdict
      example:
        type: intrusion
        date: "12-02-22"
        destinationip: "10.10.10.10"
        protocol:
          id: 17
          label: UDP
        sourceip: "10.10.10.10"
        signaturelist:
          id: 1111
        classification: malicious
        sourceport: 22
        sessionid: 190898098
        verdict: detected
        destinationport: 33
        timestamp: 1594557262000
        time: "09:30"
        identities:
          - id: 211034846
            type:
              id: 34
              type: anyconnect
              label: Anyconnect Roaming Client
            label: omerta
            deleted: false
        severity: "HIGH"
        signature:
          generatorid: 1
          id: 47829
          label: "SERVER-OTHER JBoss Richfaces expression language injection attempt"
          cves:
            - "cve-2015-0279"
            - "cve-2018-12532"

    #ActivityIP:
    #  type: object
    #  properties:
    #   date:
    #      $ref: '#/components/schemas/Date'
    #    destinationip:
    #      $ref: '#/components/schemas/DestinationIp'
    #    sourceip:
    #      $ref: '#/components/schemas/SourceIp'
    #    sourceport:
    #      $ref: '#/components/schemas/SourcePort'
    #    destinationport:
    #      $ref: '#/components/schemas/DestinationPort'
    #    verdict:
    #      type: string
    #      description: verdict for entry, allowed or blocked
    #    time:
    #      $ref: '#/components/schemas/Time'
    #    timestamp:
    #      $ref: '#/components/schemas/Timestamp'
    #    identities:
    #      type: array
    #      description: array of identities for entry
    #      items:
    #        $ref: "#/components/schemas/Identity"
    #    categories:
    #      type: array
    #      items:
    #        $ref: '#/components/schemas/Category'
    #    type:
    #      type: string
    #      description: type of the request. an ip request always has type ip
    #  required:
    #    - categories
    #    - date
    #    - destinationip
    #    - destinationport
    #    - identities
    #    - sourceip
    #    - sourceport
    #    - time
    #    - timestamp
    #    - type
    #    - verdict
    #  example:
    #    destinationip: 52.8.160.247
    #    sourceip: 192.168.0.1
    #    date: "02-15-2022"
    #    sourceport: 0
    #    destinationport: 0
    #    verdict: allowed
    #    time: "10:15"
    #    timestamp: 1548311506
    #    identities:
    #      - id: 1
    #        label: Catch Rate Testing System
    #        type:
    #          id: 21
    #          label: Sites
    #          type: site
    #        deleted: false
    #    categories:
    #      - id: 66
    #        label: Malware
    #        type: security
    #        integration: true
    #    type: ip

    IdentityDistribution:
      type: object
      properties:
        counts:
          $ref: '#/components/schemas/RequestCounts'
        requests:
          type: number
          description: the requests made by the identity type
        unique_identity_count:
          type: number
          description: the number unique identities associated with the identity type
        identitytype:
          $ref: '#/components/schemas/IdentityType'
      required:
        - counts
        - identitytype
        - requests
        - unique_identity_count
      example:
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        requests: 312
        unique_identity_count: 12
        identitytype:
          id: 21
          label: Sites
          name: site
    OrganizationDeploymentStatus:
      type: object
      required:
        - organization
        - counts
      properties:
        organization:
          $ref: '#/components/schemas/Organization'
        counts:
          type: array
          items:
            $ref: '#/components/schemas/MspDeploymentStatus'
      example:
        organization:
          id: 232323
          label: Company Name Goes Here
        counts:
          - identitytype:
              id: 21
              label: Sites
              name: site
            activecount: 1
            count: 1
    BandwidthbyHour:
      type: object
      properties:
        inboundbytes:
          type: number
        outboundbytes:
          type: number
          nullable: true
        timestamp:
          $ref: '#/components/schemas/TimestampForBucket'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
      required:
        - date
        - inboundbytes
        - outboundbytes
        - time
        - timestamp
      example:
        inboundbytes: 123
        outboundbytes: 456
        timestamp: 1559836800000
        date: "2019"
        time: 16:00:00
    TopFile:
      type: object
      properties:
        requests:
          type: number
        sha256:
          type: string
          description: sha256 for entry
        categories:
          type: array
          items:
            $ref: "#/components/schemas/Category"
        identitycount:
          type: number
          description: count of identities for entry
        filenames:
          type: array
          description: array of filenames for entry
          items:
            type: string
        filetypes:
          type: array
          description: array of filetypes for entry
          items:
            type: string
      required:
        - categories
        - filenames
        - filetypes
        - identitycount
        - requests
        - sha256
      example:
        requests: 123
        sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
        categories:
          - id: 66
            label: Malware
            type: security
            integration: true
        identitycount: 1
        filenames: []
        filetypes: []
    TopThreats:
      type: object
      properties:
        threat:
          type: string
          description: the threat name
        threattype:
          type: string
          description: the threat type
        count:
          type: number
          description: the number of requests for that threat name
      required:
        - count
        - threat
        - threattype
      example:
        threat: Wannacry
        threattype: Ransomware
        count: 361
    TopThreatTypes:
      type: object
      properties:
        threattype:
          type: string
          description: the threat type
        threatscount:
          type: number
          description: count of threats for this threat type
        count:
          type: number
          description: the number of requests for that threat type
      required:
        - count
        - threatscount
        - threattype
      example:
        threattype: Ransomware
        threatscount: 10
        count: 361
    Identity:
      type: object
      properties:
        id:
          type: number
          description: 'id of identity + organizationid: 957974 (number) - organization
            id for identity'
        label:
          type: string
          description: label for identity
        type:
          $ref: '#/components/schemas/IdentityType'
        deleted:
          type: boolean
          description: indicates whether the identity was deleted or not
      required:
        - id
        - label
        - type
        - deleted
      example:
        id: 1
        label: Catch Rate Testing System
        type:
          id: 21
          label: Sites
          type: site
        deleted: false
    Summary:
      type: object
      properties:
        applications:
          type: number
          description: total number of applications (avc or total)
        domains:
          type: number
          description: total number of domains
        requestsblocked:
          type: number
          description: total number of blocked requests
        filetypes:
          type: number
          description: total number of file types
        policycategories:
          type: number
          description: total number of blocked categories
        policyrequests:
          type: number
          description: total number of policy requests
        requests:
          type: number
          description: total number of requests
        requestsallowed:
          type: number
          description: total number of allowed requests
        categories:
          type: number
          description: total number of categories
        identitytypes:
          type: number
          description: total number of identity types
        applicationsblocked:
          type: number
          description: total number of blocked applications
        files:
          type: number
          description: total number of files
        identities:
          type: number
          description: total number of identities
        applicationsallowed:
          type: number
          description: total number of allowed applications
      required:
        - applications
        - applicationsallowed
        - applicationsblocked
        - categories
        - domains
        - files
        - filetypes
        - identities
        - identitytypes
        - policycategories
        - policyrequests
        - requests
        - requestsallowed
        - requestsblocked
      example:
        applications: 123
        domains: 82
        requestsblocked: 189
        filetypes: 0
        policycategories: 2
        policyrequests: 2
        requests: 189
        requestsallowed: 10
        categories: 11
        identitytypes: 1
        applicationsblocked: 2
        files: 5
        identities: 1
        applicationsallowed: 2
    Protocol:
      type: object
      description: ip protocol
      properties:
        id:
          type: number
          description: id of protocol
        label:
          type: string
          description: name of the protocol
      required:
        - id
        - label
    Rule:
      type: object
      description: firewall rule
      properties:
        id:
          type: number
          description: id of rule
        label:
          type: string
          description: name of the rule
        privateapplicationgroup:
          $ref: '#/components/schemas/PrivateApplicationGroup'
      required:
        - id
        - label
    PrivateApplicationGroup:
      type: object
      description:  private application group
      properties:
        id:
           nullable: true
           type: number
           description: id of application group
        label:
           nullable: true
           type: string
           description: name of application group
    IdentityType:
      type: object
      properties:
        id:
          type: number
          description: origin type for identity
        label:
          type: string
          description: origin type label for identity
        type:
          type: string
          description: origin type name for identity
    CategoryWithLegacyId:
      type: object
      properties:
        id:
          type: number
          description: id of category
        legacyid:
          type: number
          description: legacy id used by older APIs in umbrella
        label:
          type: string
          description: the human readable label of the category
        type:
          type: string
          description: the type of category
        integration:
          type: boolean
          description: if the category is an integration
        deprecated:
          type: boolean
          description: if the category is a legacy category
      required:
        - id
        - integration
        - label
        - legacyid
        - type
        - deprecated
      example:
        id: 66
        legacyid: 94
        label: Malware
        type: security
        integration: true
        deprecated: false
    Category:
      type: object
      description: array of categories
      properties:
        id:
          type: number
          description: id of category
        label:
          type: string
          description: the human readable label of the category
        type:
          type: string
          description: the type of category
        integration:
          type: boolean
          description: if the category is an integration
        deprecated:
          type: boolean
          description: if the category is a legacy category
    TopIdentity:
      type: object
      properties:
        requests:
          type: number
          description: total number of requests made by this identity
        bandwidth:
          type: number
          nullable: true
        identity:
          $ref: '#/components/schemas/Identity'
        counts:
          $ref: '#/components/schemas/RequestCounts'
        rank:
          type: number
          description: the rank of the result based on the number of requests
      required:
        - bandwidth
        - counts
        - identity
        - rank
        - requests
      example:
        requests: 3827
        bandwidth: 7051943359
        identity:
          id: 1
          label: Catch Rate Testing System
          type:
            id: 21
            label: Sites
            type: site
          deleted: false
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        rank: 3
    TopDestination:
      type: object
      properties:
        bandwidth:
          type: number
          nullable: true
        rank:
          type: number
          description: the rank of the result based on the number of requests
        domain:
          type: string
          description: destination
        count:
          type: number
          description: total number of requests made for this destination
        counts:
          $ref: '#/components/schemas/RequestCounts'
        categories:
          type: array
          items:
            $ref: "#/components/schemas/Category"
        policycategories:
          type: array
          description: |-
            policy categories associated with the destination (i.e., categories
            that are blocked for)
          items:
            $ref: "#/components/schemas/Category"
      required:
        - bandwidth
        - categories
        - count
        - counts
        - domain
        - policycategories
        - rank
      example:
        bandwidth: 223437
        rank: 4
        domain: google.com
        count: 3827
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        categories:
          - id: 66
            label: Malware
            type: security
            integration: true
        policycategories:
          - id: 66
            label: Malware
            type: security
            integration: true
    TopCategory:
      type: object
      properties:
        rank:
          type: number
          description: the rank of the result based on the number of requests
        category:
          $ref: '#/components/schemas/Category'
        count:
          type: number
          description: number of requests made that match this category
        bandwidth:
          type: number
          nullable: true
      required:
        - category
        - count
        - rank
      example:
        rank: 5
        category:
          id: 66
          label: Malware
          type: security
          integration: true
        count: 3827
    TopEventType:
      type: object
      properties:
        eventtype:
          type: string
          description: |-
            the eventtype. one of "domain_security", "domain_integration",
            "url_security", "url_integration", "cisco_amp" and "antivirus"
        count:
          type: number
          description: number of requests made that match this eventtype
      required:
        - count
        - eventtype
      example:
        eventtype: ""
        count: 3827
    RequestsbyHour:
      type: object
      properties:
        count:
          type: number
        counts:
          $ref: '#/components/schemas/RequestCounts'
        timestamp:
          $ref: '#/components/schemas/TimestampForBucket'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
      required:
        - count
        - counts
        - date
        - time
        - timestamp
      example:
        count: 123
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        timestamp: 1559836800000
        date: "2019"
        time: 16:00:00
    RequestsbyOrganization:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/Organization'
        counts:
          $ref: '#/components/schemas/RequestsByOrgCounts'
      required:
        - counts
        - organization
      example:
        organization:
          id: 232323
          label: Company Name Goes Here
        counts:
          total: 1
          totalblocked: 1
    RequestsbyCategory:
      type: object
      properties:
        category:
          $ref: '#/components/schemas/Category'
        counts:
          $ref: '#/components/schemas/MspCountsByCategory'
      required:
        - category
        - counts
      example:
        category:
          id: 66
          label: Malware
          type: security
          integration: true
        counts:
          total: 1
          totalblocked: 1
          numberoforganizationsaffected: 1
    MspRequestsbyDestination:
      type: object
      properties:
        domain:
          type: string
        categories:
          type: array
          items:
            $ref: "#/components/schemas/Category"
        counts:
          $ref: '#/components/schemas/MspCountsByDestination'
      required:
        - categories
        - counts
        - domain
      example:
        domain: ""
        categories:
          - id: 66
            label: Malware
            type: security
            integration: true
        counts:
          total: 1
          totalblocked: 1
          numberoforganizationsaffected: 1
    CategoryByHour:
      required:
        - counts
        - date
        - time
        - timestamp
      type: object
      properties:
        timestamp:
          $ref: '#/components/schemas/TimestampForBucket'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
        counts:
          type: array
          items:
            $ref: "#/components/schemas/CategoryCount"
      example:
        timestamp: 1559836800000
        date: "2019"
        time: 16:00:00
        counts:
          - category:
              id: 66
              label: Malware
              type: security
              integration: true
            requests: 123
    CategoryCount:
      type: object
      properties:
        category:
          $ref: '#/components/schemas/Category'
        requests:
          type: number
          description: total number of requests for category
      required:
        - category
        - requests
    Application:
      type: object
      properties:
        id:
          type: number
          description: id of the application
        label:
          type: string
          description: label of the application
        type:
          type: string
          description: type of the application, NBAR or AVC
        category:
          type: object
          description: the category of the application
          properties:
            id:
              type: number
              description: id of the application category
            label:
              type: string
              description: label of the application category
    ApplicationCategories:
      type: object
      properties:
        id:
          type: number
          description: id of the application category
        name:
          type: string
          description: name of the application category
    ApplicationsWithCategories:
      type: object
      properties:
        applications:
          type: array
          items:
            $ref: '#/components/schemas/Application'
        categories:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationCategories'
      example:
        applications:
          - id: 1
            label: "Web Hosting"
            type: "AVC"
            category:
              id: 40
              label: "Hosting Services"
        categories:
          - id: 42
            name: "Education"
    FirewallApplication:
      type: object
      properties:
        id:
          type: number
          description: application/protocol id
        label:
          type: string
          description: application/protocol label
        app:
          type: string
          description: 'type: "IT Service Management" (string) - application/protocol
            type'
    ActivityDns:
      type: object
      properties:
        externalip:
          type: string
          description: external IP for entry
        internalip:
          type: string
          description: internal IP for entry
        policycategories:
          type: array
          description: array of policy categories
          items:
            $ref: '#/components/schemas/Category'
        categories:
          type: array
          description: array of categories
          items:
            $ref: '#/components/schemas/Category'
        verdict:
          type: string
          description: verdict for entry
        domain:
          type: string
          description: domain for entry
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        identities:
          type: array
          description: array of identities for entry
          items:
            $ref: "#/components/schemas/Identity"
        allapplications:
          type: array
          description: array of applications for entry
          items:
            $ref: "#/components/schemas/Application"
        threats:
          type: array
          items:
            $ref: "#/components/schemas/Threat"
          description: array of threats for entry
        type:
          type: string
          description: type of the request. a dns request always has type dns
        querytype:
          type: string
          description: The type of DNS request that was made. For more information, see Common DNS Request Types.
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
        returncode:
          type: number
          description: The DNS return code for this request. For more information, see Common DNS return codes for any DNS service (and Umbrella).
        allowedapplications:
          type: array
          items:
            $ref: '#/components/schemas/Application'
        blockedapplications:
          type: array
          items:
            $ref: '#/components/schemas/Application'
      required:
        - allapplications
        - allowedapplications
        - blockedapplications
        - categories
        - date
        - domain
        - externalip
        - identities
        - internalip
        - policycategories
        - querytype
        - returncode
        - threats
        - time
        - timestamp
        - type
        - verdict
      example:
        externalip: 52.8.160.247
        internalip: 52.8.160.247
        policycategories:
          - id: 66
            label: Malware
            type: security
            integration: true
        categories:
          - id: 66
            label: Malware
            type: security
            integration: true
        verdict: allowed
        domain: google.com
        timestamp: 1548311506
        time: "06:31:46"
        date: "2019-01-24"
        identities:
          - id: 1
            label: Catch Rate Testing System
            type:
              id: 21
              label: Sites
              type: site
            deleted: true
        threats:
          - label: Wannacry
            type: Ransomware
        allapplications:
          - id: 1
            label: label
            type: NBAR
            category:
              id: 1
              label: category
        allowedapplications:
          - id: 1
            label: label
            type: NBAR
            category:
              id: 1
              label: category
        querytype: MX
        returncode: 2
        blockedapplications: []
        type: dns
    ActivityAMPRetro:
      type: object
      properties:
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        firstseenat:
          type: number
          description: timestamp
        disposition:
          type: string
          description: disposition for entry
        score:
          type: number
          description: score for entry
        hostname:
          type: string
          description: hostname for entry
        malwarename:
          type: string
          description: malware name for entry
        sha256:
          type: string
          description: sha256 for entry
      required:
          - disposition
          - firstseenat
          - hostname
          - malwarename
          - score
          - sha256
          - timestamp
      example:
        timestamp: 1548311506
        firstseenat: 1548311506
        disposition: clean
        score: 10
        hostname: google.com
        malwarename: malware
        sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
    CiscoAMP:
      type: object
      description: AMP disposition/score/malware
      properties:
        score:
          type: number
          description: AMP score
        disposition:
          type: string
          description: AMP disposition
        malware:
          type: string
          description: AMP malware
      required:
        - disposition
        - malware
        - score
    AntivirusThreats:
      type: object
      properties:
        puas:
          type: array
          description: Potentially unwanted applications
          items:
            type: object
        viruses:
          type: array
          description: Viruses
          items:
            type: string
        others:
          type: array
          description: Other antivirus threats
          items:
            type: object
      required:
        - others
        - puas
        - viruses
    Threat:
      type: object
      properties:
        label:
          type: string
          description: the threat name or label
        type:
          type: string
          description: the type of threat
    Organization:
      type: object
      properties:
        id:
          type: number
          description: orgid
        label:
          type: string
    RequestsByOrgCounts:
      type: object
      properties:
        total:
          type: number
          description: total number of requests
        totalblocked:
          type: number
          description: blocked requests
      required:
        - total
        - totalblocked
    MspCategoryRequestsByOrganization:
      required:
        - counts
        - organization
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/Organization'
        counts:
          type: array
          items:
            $ref: "#/components/schemas/CategoryRequests"
      example:
        organization:
          id: 232323
          label: Company Name Goes Here
        counts:
          - category:
              id: 66
              label: Malware
              type: security
              integration: true
            requests: 123
            requestsblocked: 34
            numberoforganizationswithcategorizedtraffic: 1
    MspRequestsByHour:
      type: object
      properties:
        counts:
          properties:
            requests:
              type: number
              description: total number of requests
            allowedrequests:
              type: number
              description: number of requests that were allowed
              nullable: true
            blockedrequests:
              type: number
              description: number of requests that were blocked
              nullable: true
          required:
            - requests
            - allowedrequests
            - blockedrequests
        count:
          type: number
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
        timestamp:
          $ref: '#/components/schemas/TimestampForBucket'
      required:
        - count
        - date
        - time
        - timestamp
      example:
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        count: 0
        date: "2020-04-01"
        time: "05:00:00"
        timestamp: 1585717200000
    MspCountsByCategory:
      type: object
      properties:
        total:
          type: number
          description: total number of requests
        totalblocked:
          type: number
          description: blocked requests
        numberoforganizationsaffected:
          type: number
          description: number of organizations with traffic for that category
      required:
        - numberoforganizationsaffected
        - total
        - totalblocked
    MspCountsByDestination:
      type: object
      properties:
        total:
          type: number
          description: total number of requests
        totalblocked:
          type: number
          description: blocked requests
        numberoforganizationsaffected:
          type: number
          description: number of organizations with traffic for that category
      required:
        - numberoforganizationsaffected
        - total
        - totalblocked
    MspDeploymentStatus:
      type: object
      properties:
        identitytype:
          $ref: '#/components/schemas/IdentityType'
        activecount:
          type: number
          description: active identity type count
        count:
          type: number
          description: total identity type count
      required:
        - activecount
        - count
        - identitytype
      example:
        identitytype:
          id: 21
          label: Sites
          name: site
        activecount: 1
        count: 1
    CategoryRequests:
      type: object
      properties:
        category:
          $ref: '#/components/schemas/Category'
        requests:
          type: number
          description: number of requests
        requestsblocked:
          type: number
          description: number of requests that were blocked
        numberoforganizationswithcategorizedtraffic:
          type: number
          description: number of organizations with traffic for that category
    DataCenter:
      type: object
      properties:
        id:
          type: string
          description: Unique ID for the data center
        label:
          type: string
          description: Name of the data center
      required:
        - id
        - label
      example:
        id: LAX
        label: Los Angeles, US
    DataLossPreventionState:
      type: object
      properties:
        state:
          type: string
          description: If the request was Blocked for DLP. Either 'blocked' or ''
      required:
        - state
      example:
        state: blocked
    DeploymentStatus:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/IdentityType'
        activecount:
          type: number
          description: active identity type count
        count:
          type: number
          description: total identity type count
      required:
        - activecount
        - count
        - type
      example:
        type:
          id: 21
          label: Sites
          name: site
        activecount: 1
        count: 1
    Egress:
      type: object
      properties:
        ip:
          type: string
          description: Egress IP
        type:
          type: string
          description: Egress Type
      required:
        - ip
        - type
      example:
        ip: "155.190.3.8"
        type: shared
    TopIP:
      type: object
      properties:
        ip:
          type: string
          description: the ip addresses
        count:
          type: number
          description: the number of requests
      required:
        - count
        - ip
      example:
        ip: 10.0.0.1
        count: 42
    RequestCounts:
      type: object
      properties:
        requests:
          type: number
          description: total number of requests
        allowedrequests:
          type: number
          description: number of requests that were allowed
        blockedrequests:
          type: number
          description: number of requests that were blocked
    TopDnsQueryType:
      type: object
      properties:
        requests:
          type: number
          description: total number of requests
        querytype:
          type: string
          description: DNS query type
      required:
        - querytype
        - requests
      example:
        requests: 123
        querytype: A
    TopURL:
      type: object
      properties:
        count:
          type: number
          description: total number of requests
        path:
          type: string
          description: the URL path
        categories:
          type: array
          items:
            $ref: "#/components/schemas/Category"
        rank:
          type: number
          description: ranking of the top url
      required:
        - categories
        - count
        - path
        - rank
      example:
        count: 123
        path: ""
        categories:
          - id: 66
            label: Malware
            type: security
            integration: true
        rank: 1
    TotalRequest:
      type: object
      properties:
        count:
          type: number
      required:
        - count
      example:
        count: 42
    SummaryWithCategory:
      type: object
      properties:
        category:
          $ref: '#/components/schemas/Category'
        summary:
          $ref: '#/components/schemas/Summary'
      required:
        - category
        - summary
      example:
        category:
          id: 66
          label: Malware
          type: security
          integration: true
        summary:
          applications: 123
          domains: 82
          requestsblocked: 189
          filetypes: 0
          policycategories: 2
          policyrequests: 2
          requests: 189
          requestsallowed: 10
          categories: 11
          identitytypes: 1
          applicationsblocked: 2
          files: 5
          identities: 1
          applicationsallowed: 2
    SummaryWithDestination:
      type: object
      properties:
        domain:
          type: string
          description: destination domain
        summary:
          $ref: '#/components/schemas/Summary'
      required:
        - domain
        - summary
      example:
        domain: www.google.com
        summary:
          applications: 123
          domains: 82
          requestsblocked: 189
          filetypes: 0
          policycategories: 2
          policyrequests: 2
          requests: 189
          requestsallowed: 10
          categories: 11
          identitytypes: 1
          applicationsblocked: 2
          files: 5
          identities: 1
          applicationsallowed: 2
    SignatureListSummary:
      type: object
      properties:
        signaturelist:
          $ref: '#/components/schemas/SignatureList'
        signatures:
          type: array
          items:
            type: object
            properties:
              generatorid:
                type: number
              id:
                type: number
              lasteventat:
                type: number
              counts:
                type: object
                properties:
                  blocked:
                    type: number
                  detected:
                    type: number
                  wouldblock:
                    type: number
                required:
                  - blocked
                  - detected
                  - wouldblock
      example:
        signaturelist:
          id: 1111
        signatures:
          - counts:
              blocked: 0
              detected: 1
              wouldblock: 0
            generatorid: 1
            lasteventat: 1594557262000
            id: 47829
    ThreatType:
      type: object
      properties:
        name:
          type: string
          description: name of the threat-type
        description:
          type: string
          description: description of the threat-type
      required:
        - name
        - description
      example:
        name: Ransomware
        description: a description
    ThreatName:
      type: object
      properties:
        name:
          type: string
          description: name of the threat name
        description:
          type: string
          description: description of the threat name
      required:
        - name
        - description
      example:
        name: WannaCry
        description: a description
    Policy:
      type: object
      required:
        - destinationlistids
        - ruleid
        - rulesetid
        - timebasedrule
      properties:
        timebasedrule:
          type: boolean
          description: whether the policy triggered a time-of-day rule
        destinationlistids:
          type: array
          description: the destination lists that the policy triggered
          items:
            type: number
        ruleid:
          type: number
          description: the rule ID for the policy
          nullable: true
        rulesetid:
          type: number
          description: the rule set ID for the policy
          nullable: true
    HttpError:
      type: object
      properties:
        type:
          type: string
          description: type of the error `CertificateError` or `TLSError`
        code:
          type: number
          description: the http error code
        reason:
          type: string
          description: the name of the error
        attributes:
          type: object
          description: map of additional information about the error
    Isolated:
      type: object
      properties:
        state:
          type: string
        fileaction:
          type: string
      required:
        - state
        - fileaction
      example:
        state: not-isolated
        fileaction: ""
    Meta:
      type: object
      example: {}
    Signature:
      type: object
      properties:
        generatorid:
          type: number
          description: Unique id assigned to the part of the IPS which generated the event.
        id:
          type: number
          description: Used to uniquely identify signatures.
        label:
          type: string
          description: A brief description of the signature.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/CVE'
      required:
        - generatorid
        - id
        - label
        - cves
      example:
        generatorid: 148
        id: 2
        label: (cip) CIP data is non-conforming to ODVA standard
        cves: ['cve-2015-0279']
    SignatureList:
      type: object
      properties:
        id:
          type: number
          description: Unique id assigned to a Default or Custom Signature List.
      required:
        - id
      example:
        id: 1112
    Classification:
      type: string
      description: The category of attack detected by a rule that is part of a more general type of attack class, such as trojan-activity, attempted-user, and unknown.
      example: trojan-activity
    CVE:
      type: string
      description: An identifier for a known security vulnerability/exposure
      example: cve-2015-0279
    Date:
      type: string
      description: the date from the timestamp based on the timezone parameter
      example: '2020-07-12'
    DestinationIp:
      type: string
      description: destination IP for entry
      example: "12.10.10.10"
    DestinationPort:
      type: number
      description: destination port for entry
      example: 89
    SessionId:
      type: number
      description: The unique identifier of a session, which is used to group the correlated events between various services.
      example: 7878797
    Severity:
      type: string
      description: The severity level of the rule, such as High, Medium, Low, and Very Low.
      example: High
    SourceIp:
      type: string
      description: source IP for entry
      example: "10.11.10.10"
    SourcePort:
      type: number
      description: source port for entry
      example: 3000
    Time:
      type: string
      description: the time in 24 hour format based on the timezone parameter
      example: "12:34"
    Timestamp:
      type: number
      description: timestamp in ms
      example: 1594557263000
    TimestampForBucket:
      type: number
      description: timestamp in ms for this bucket
      example: 1594557263000

    RemoteAccess:
      type: object
      required:
        - osversion
        - internalip
        - connecttimestamp
        - reason
        - failedreasons
        - connectionevent
        - anyconnectversion
        - timestamp
        - identities
      properties:
        osversion:
          type: string
          description: The OS version of the host
          example: linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)
        internalip:
          type: string
          description: The internal IP address of the host
          example: 10.0.1.5
        connecttimestamp:
          type: number
          description: The time and date when the host connected, expressed in milliseconds
          example: 1667252442
        reason:
          type: string
          description: The reason the event occurred for the remote access endpoint
          example: ACCT_DISC_USER_REQ
        failedreasons:
          type: array
          items:
            type: string
          description: A list of messages that describe the remote access error
          example: []
        connectionevent:
          type: string
          description: The type of event associated with the remote connection
          example: disconnected
        anyconnectversion:
          type: string
          description: The version of the AnyConnect Roaming Security module
          example: 4.10.05095
        timestamp:
          type: number
          description: The time and date of the event, expressed in milliseconds
          example: 1667252458
        identities:
          type: array
          items:
            type: object
            properties:
              id:
                type: integer
                format: int32
                description: The id of the remote access endpoint
                example: 1173502975
              type:
                type: object
                properties:
                  id:
                    type: integer
                    description: The ID of the type
                    example: 7
                  type:
                    type: string
                    description: The descriptive type
                    example: directory_user
                  label:
                    type: string
                    description: The label for the type
                    example: AD Users
              label:
                type: string
                description: The label for the remote access identity
                example: sample-endpoint@cisco.com
              deleted:
                type: boolean
                description: Specifies whether the identity is available
                example: false
      example:
        osversion: linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)
        internalip: 10.0.1.5
        connecttimestamp: 1667252442
        reason: ACCT_DISC_USER_REQ
        failedreasons: []
        connectionevent: disconnected
        anyconnectversion: 4.10.05095
        timestamp: 1667252458
        identities:
          - id: 1173502975
            type:
              id: 7
              type: directory_user
              label: AD Users
            label: sample-remote-access@cisco.com
            deleted: false

  securitySchemes:
    oauthFlow:
      type: oauth2
      description: "client credential flow"
      flows:
        clientCredentials:
          tokenUrl: https://management.api.umbrella.com/auth/v2/oauth2/token
          scopes: {}

  responses:
    400Error:
      description: Invalid request
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Invalid request
    401Error:
      description: Unauthorized request
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Unauthorized request
    403Error:
      description: Forbidden
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Forbidden
    404Error:
      description: Not Found
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Not Found
    500Error:
      description: Server error
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Server error
