22

✏️ Editing: incidents.yaml

get:
  help: |
    List incidents
  return_type: IncidentsAgentResponse
  cli:
    users:
      - root
  type: dict
  schema:
    by_abuser_ip:
      type: string
      nullable: true
      help: |
        Filter by abuser IP address

by_country_code:
      type: string
      nullable: true
      help: |
        Filter by country code

by_panel_user:
      type: string
      nullable: true
      help: |
        Filter by panel user domains

by_plugin:
      type: string
      nullable: true
      help: |
        Filter by plugin name (e.g., modsec, ossec, etc.)

by_list:
      type: list
      nullable: true
      schema:
        type: string
        allowed:
          - white
          - black
          - gray
      help: (internal)

by_purpose:
      type: list
      nullable: true
      schema:
        type: string
        allowed:
          - white
          - drop
          - captcha
      help: (internal)

severity:
      type: integer
      coerce: int
      nullable: true
      help: |
        Filter by minimum severity (1-15).
        See https://www.ossec.net/docs/manual/rules-decoders/rule-levels.html for details on severity levels.
    search:
      type: string
      nullable: true
      help: |
        Search by IP address, name, description.

limit:
      type: integer
      coerce: int
      default: 50
      help: Page size
    offset:
      type: integer
      coerce: int
      default: 0
      help: Page offset

since:
      type: integer
      coerce: int
      excludes: period
      check_with:
        - timestamp
      help: |
        Show incidents after this unix timestamp.

to:
      type: integer
      coerce: int
      check_with:
        - timestamp
      default_setter: now
      help: |
        Show incidents before this unix timestamp.

period:
      type: period
      coerce: period
      excludes: since
      help: (internal)
    order_by:
      type: list
      schema:
        type: order_by
        coerce: order_by
      nullable: true
      help: |
        List of fields to order by, each followed by a `+` (ascending) or `-` (descending).
        E.g. `["severity+","timestamp-"]` would order by event severity ascending and timestamp descending.

clean:
  help: (internal)
  cli:
    users:
      - root
  type: dict
  schema:
    days:
      type: integer
      coerce: int
      min: 0
      check_with:
        - max_days
    limit:
      type: integer
      coerce: int

MR SKB