Intel471Ex.Watchers (intel471_ex v0.2.0)

Copy Markdown

Functions for working with the Intel 471 Verity Watchers API.

Service path: integrations/watchers/v1

Summary

Functions

alerts_stream(params \\ %{})

Stream alerts triggered by watchers (cursor-paginated).

update_alert_status(id, status)

Update the status of an alert.

watcher_groups(params \\ %{})

List or search watcher groups.

watchers(params \\ %{})

List or search watchers.

Functions

alerts_stream(params \\ %{})

@spec alerts_stream(map()) :: {:ok, map()} | {:error, any()}

Stream alerts triggered by watchers (cursor-paginated).

Parameters

  • params: A map of query parameters
    • :cursor / :size — Pagination
    • :from / :until — Time range
    • :watcher_group_ids — Filter by watcher group IDs
    • :watcher_ids — Filter by watcher IDs
    • :statuses — Filter by alert statuses
    • :is_trashed_included — Include trashed alerts

Examples

{:ok, result} = Intel471Ex.Watchers.alerts_stream(%{size: 10})

update_alert_status(id, status)

@spec update_alert_status(integer(), String.t()) :: {:ok, map()} | {:error, any()}

Update the status of an alert.

Parameters

  • id: The alert ID
  • status: New status (e.g., "read", "unread")

Examples

{:ok, _} = Intel471Ex.Watchers.update_alert_status(12345, "read")

watcher_groups(params \\ %{})

@spec watcher_groups(map()) :: {:ok, map()} | {:error, any()}

List or search watcher groups.

Parameters

  • params: A map of query parameters
    • :watcher_group_id — Filter by group ID
    • :watcher_group_type — Filter by group type
    • :name — Filter by name

Examples

{:ok, result} = Intel471Ex.Watchers.watcher_groups()
{:ok, result} = Intel471Ex.Watchers.watcher_groups(%{name: "Ransomware"})

watchers(params \\ %{})

@spec watchers(map()) :: {:ok, map()} | {:error, any()}

List or search watchers.

Parameters

  • params: A map of query parameters
    • :watcher_id — Filter by watcher ID
    • :watcher_group_id — Filter by watcher group ID
    • :dsl_query — Filter by DSL query
    • :watcher_group_type — Filter by watcher group type
    • :name — Filter by name

Examples

{:ok, result} = Intel471Ex.Watchers.watchers(%{watcher_group_id: "group-id"})