Skip to content

policyViolationsByResource

Get a paginated list of policy violations grouped by resource.

Arguments

Argument Type Description
first Int Returns the first n elements from the list.
after String Returns the elements in the list that occur after the specified cursor.
last Int Returns the last n elements from the list.
before String Returns the elements in the list that occur before the specified cursor.
policyIds [UUID!] Policy IDs to filter by. If empty or null, the results will not be filtered.
resourceIds [String!] Resource IDs to filter by. If empty or null, the results will not be filtered.
statuses [PolicyViolationStatus!] Policy violation statuses to filter by. If empty or null, the results will not be filtered.
statusReasons [PolicyViolationStatusReason!] Policy violation status reasons to filter by. If empty or null, the results will not be filtered.
policyTypes (required) [PolicyType!]! List of policy types. If empty, no results will be returned.
policyViolationIds [UUID!] Policy violation IDs to filter by. If empty or null, the results will not be filtered.
policySeverities [Severity!] Policy severities to filter by. If empty or null, the results will not be filtered.
policyCategories [Category!] Policy categories to filter by. If empty or null, the results will not be filtered.
includeDeletedPolicies Boolean Include deleted policies in the results. If null or false, deleted policies will be excluded.
resourceTypes [PolicyResourceType!] Resource types to filter by. If empty or null, the results will not be filtered.
sensitivityLevels [SensitivityLevel!] Sensitivity levels to filter by. If empty or null, the results will not be filtered.
detectionDate TimeRangeInput Detection date range to filter by. If null, the results will not be filtered.
updateDate TimeRangeInput Violation update date range to filter by.
parentViolationId UUID Parent violation ID.
dataTypeIds [String!] Data type IDs to filter.
documentTypeIds [UUID!] Document type IDs to filter.
dataCategoryIds [String!] Filter for data category IDs.
sortBy PolicyViolationSortField Field by which to sort policy violations.
sortOrder SortOrder Sort order for policy violations.
policyViolationNameSearch String Policy violation name to search for (substring match).
principalMetadataFilters PrincipalMetadataFiltersInput Principal metadata fields to filter by. If null, the results will not be filtered.
policyFrameworks [String!] Policy frameworks to filter by. If empty or null, the results will not be filtered.
violationNames [String!] Exact violation names to filter by. OR-combined with policyIds: a violation matches if its policyId is in policyIds OR its violationName is in violationNames. Distinct from policyViolationNameSearch (substring match, AND-combined).

Returns

PolicyViolationsByResourceConnection!

Sample

query PolicyViolationsByResource($policyTypes: [PolicyType!]!) {
  policyViolationsByResource(
    policyTypes: $policyTypes
    first: 10
  ) {
    nodes {
      activeViolationsCount
      criticalSeverityViolationCount
      resourceId
      resourceType
      severity
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}

{
  "policyTypes": [
    "POLICY_TYPE_CROWDSTRIKE"
  ]
}

{
  "data": {
    "policyViolationsByResource": {
      "nodes": [
        [
          {
            "activeViolationsCount": 0,
            "criticalSeverityViolationCount": 0,
            "resourceId": "example-string",
            "resourceType": "RESOURCE_TYPE_IDENTITY",
            "severity": "CRITICAL"
          }
        ]
      ],
      "pageInfo": {
        "endCursor": "example-string",
        "hasNextPage": true,
        "hasPreviousPage": true,
        "startCursor": "example-string"
      }
    }
  }
}