Operations 12
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
GET
/api/deviances/changed
List deviances created or resolved since an event · Get all deviances that has been created or resolved since an event
#
Ask an LLM
“Which deviances appeared or got resolved since the last event I processed?”
“Can I poll for newly created and resolved deviances incrementally?”
Tell an agent
List deviances created or resolved since the last event.
Show changed deviances since my last sync.
GET
/api/directories/{directoryId}/deviances/{id}
Get a deviance history entry in a directory · Get ad-object-deviance-history instance by id
#
Ask an LLM
“How do I look up one deviance history record by id within a directory?”
“What is the history of a single deviance in a domain?”
Tell an agent
Get deviance {id} in directory {directoryId}.
Show history record {id} for directory {directoryId}, no forest needed.
GET
/api/export/profiles/{profileId}/checkers/{checkerId}
Export a checker's deviant objects as CSV · Get all ad objects of a deviance in CSV rows format
#
Ask an LLM
“Can I download all AD objects failing an indicator as CSV?”
“How do I export deviances for one checker in my language?”
Tell an agent
Export deviant objects for checker {checkerId} in profile {profileId} as CSV.
Download the checker {checkerId} deviance CSV for profile {profileId} in {language}.
GET
/api/infrastructures/{infrastructureId}/directories/{directoryId}/deviances
List deviances in a directory · Get all deviances for a directory
#
Ask an LLM
“Which deviances exist across one domain, regardless of checker?”
“Can I page through only resolved deviances for a directory?”
Tell an agent
List deviances for directory {directoryId} in forest {infrastructureId}.
Show resolved={resolved} deviances in directory {directoryId} of forest {infrastructureId}.
GET
/api/infrastructures/{infrastructureId}/directories/{directoryId}/deviances/{id}
Get a deviance history entry in a forest · Get ad-object-deviance-history instance by id
#
Ask an LLM
“How do I read one deviance record when I know its forest and domain?”
“When was a specific deviance in a forest's directory first seen?”
Tell an agent
Get deviance {id} in directory {directoryId} of forest {infrastructureId}.
Show deviance history {id} from infrastructure {infrastructureId}, domain {directoryId}.
PATCH
/api/infrastructures/{infrastructureId}/directories/{directoryId}/deviances/{id}
Ignore one deviance until a date · Update ad-object-deviance-history instance
#
Ask an LLM
“Can I snooze a single deviance until a certain date?”
“How do I ignore one specific deviance temporarily?”
Tell an agent
Ignore deviance {id} in directory {directoryId} of forest {infrastructureId} until {ignoreUntil}.
Snooze deviance {id} in {infrastructureId}/{directoryId} until {ignoreUntil}.
GET
/api/profiles/{profileId}/infrastructures/{infrastructureId}/directories/{directoryId}/checkers/{checkerId}/deviances
List a checker's deviances in one directory · Get all deviances related to a single directory and checker
#
Ask an LLM
“Which deviances does one indicator raise in a single domain?”
“Can I narrow a checker's findings to one directory?”
Tell an agent
List deviances of checker {checkerId} in directory {directoryId}, forest {infrastructureId}, profile {profileId}.
Show page {page} of checker {checkerId} findings for domain {directoryId} in {infrastructureId} under profile {profileId}.
PATCH
/api/profiles/{profileId}/checkers/{checkerId}/deviances
Ignore all deviances of a checker · Update instances matching a checkerId
#
Ask an LLM
“Can I ignore every deviance from one indicator until a date?”
“How do I bulk-snooze a checker's findings for a profile?”
Tell an agent
Ignore all deviances of checker {checkerId} in profile {profileId} until {ignoreUntil}.
Bulk snooze checker {checkerId} findings under profile {profileId} until {ignoreUntil}.
POST
/api/profiles/{profileId}/checkers/{checkerId}/deviances
Query deviances for a checker · Get all deviances by checker
#
Ask an LLM
“How do I get all deviances an indicator raised across every domain?”
“Can I filter a checker's deviances with an expression?”
Tell an agent
Get deviances for checker {checkerId} in profile {profileId} matching {expression}.
Query all directories for checker {checkerId} deviances in profile {profileId} using filter {expression}.
PATCH
/api/profiles/{profileId}/checkers/{checkerId}/ad-objects/{adObjectId}/deviances
Ignore a checker's deviances on one AD object · Update the deviances emitted on a specific AD object and for a specific checker
#
Ask an LLM
“How do I ignore the deviances one indicator raised on a single object?”
“Can I snooze an object's findings only for certain reasons?”
Tell an agent
Ignore checker {checkerId} deviances on object {adObjectId} in profile {profileId} until {ignoreUntil}.
Snooze object {adObjectId} findings for reasons {reasonIds} on checker {checkerId}, profile {profileId}, until {ignoreUntil}.
POST
/api/profiles/{profileId}/checkers/{checkerId}/ad-objects/{adObjectId}/deviances
Search a checker's deviances on one AD object · Search all deviances by profile by checker by AD object
#
Ask an LLM
“What deviances has a single AD object accumulated for one indicator?”
“Can I see deviance history on an object within a date range?”
Tell an agent
Search deviances on AD object {adObjectId} for checker {checkerId} in profile {profileId}, ignored {showIgnored}.
Show object {adObjectId} deviances for checker {checkerId}, profile {profileId}, from {dateStart} to {dateEnd}.
POST
/api/profiles/{profileId}/infrastructures/{infrastructureId}/directories/{directoryId}/events/{eventId}/deviances
List deviances caused by an event · Get all deviances by eventId
#
Ask an LLM
“Which deviances did a specific AD change event introduce?”
“Can I filter an event's deviances by checker and reason?”
Tell an agent
Get deviances from event {eventId} in directory {directoryId}, forest {infrastructureId}, profile {profileId} for checkers {checkers} and reasons {reasons}.
Show what event {eventId} broke in {infrastructureId}/{directoryId} under profile {profileId}.