Monitoring
List finding patterns
See what the runs behind one finding have in common.
How it works
A pattern groups the runs that missed a rule in the same way: the answers they share to the questions Ollive checked. Patterns come with the most runs first.
To see a pattern’s runs, send its pattern_id to List finding runs.
Request body
application/json
- agent_idstringrequired
The finding’s agent.
- rule_idstringrequired
The finding’s rule:
rule.idfrom List findings. - rule_set_idstring (uuid)
Only the rule as checked in this rule set.
- startstring (date-time)
The start of the time range, included. Defaults to 30 days before
end. - endstring (date-time)
The end of the time range, not included. Defaults to now.
- limitintegerdefault 10up to 50
How many to return per page.
- cursorstring
The
next_cursorfrom the previous page. - include_totalboolean
Also return
total_count, the number of matches across all pages. Counting takes extra time, so ask only when you show it. - sourcestringdefault platform
Which runs to count:
platformfor ones Ollive collected,apiormcpfor ones sent to Ollive.platformapimcp
Response
The patterns. An empty list if there are none.
- dataobject[]required
One entry per pattern.
- pattern_idstringrequired
The pattern’s ID.
- run_countintegerrequired
How many runs are in this pattern.
- severitystringrequired
How serious it is.
unknownwhen the rule has no rating.criticalhighmediumlowunknown - checksobject[]required
The answers the runs in this pattern share.
- questionstringrequired
The question Ollive answered.
- answerstringrequired
The answer.
truefalseunknown - answered_fromstringrequired
Where the answer came from: the run itself, or what you told Ollive about the agent or your organization.
runagentorganizationunknown
- total_countinteger
How many match, across all pages. Only with
include_total. - has_morebooleanrequired
Whether there is another page.
- next_cursorstring
Send this as
cursorto get the next page. Not included on the last page.
Something in the request is wrong. code and param tell you what.
Returns an error, for example with the code invalid_request.
The API key is missing, wrong, revoked or expired.
Returns an error, for example with the code authentication_failed.