Skip to main content

Overview

GET 
/api/security/overview

Everything on the Security landing page, from real tables. No number here is hard-coded; a count of zero is a real zero because the table was read. Filters (API_CHANGES section 3): range 24h | 7d | 30d. Scopes what is a COUNT OVER TIME: events, the trend, recent violations, activity and findings_new. Finding / candidate / incident figures are CURRENT STATE ("open now") and are not narrowed by the range, so a tile and the findings list it opens always agree. agent_id narrows events, findings, shadow candidates and the agent ranking to one agent (tenant-wide: observed / registered agents, incidents, source health). severity comma list of finding severities; narrows the finding figures only. Definitions: observed_agents discovered_entities of type 'agent' not in lifecycle 'deleted' (every agent any source has seen) registered_agents agents-table rows (published to the catalog) whose entity is not deleted suspected/confirmed_unmanaged shadow_agent_candidates by classification, excluding ones suppressed by an exception/false positive repeated_policy_violations open findings of DET-001 / DET-012 findings_awaiting_triage open findings with no assignee backlog.total open findings + new shadow candidates + open incidents (open = not resolved and not closed)

Request​

Responses​

Successful Response