Risk Commands

• getRiskyHosts
• getRiskyUsers

getRiskyHosts

---

Retrieves the risk score of a specific host, or the hosts with the highest risk scores in the environment.

Arguments

Argument Name	Description	Required
host_id	The host name of a specific host.	Optional
limit	Limit the number of hosts that will appear in the list. (Use limit when no specific host is requested). Default is 10.	Optional

Outputs

Core.RiskyHost.type string

Form of identification element.

Core.RiskyHost.id string

Identification value of the type field.

Core.RiskyHost.score number

The score assigned to the host.

Core.RiskyHost.risk_level string

The risk level of the host.

Core.RiskyHost.norm_risk_score number

The normalized risk score of the host.

Core.RiskyHost.reasons.date created string

Date when the incident was created.

Core.RiskyHost.reasons.description string

Description of the incident.

Core.RiskyHost.reasons.severity string

The severity of the incident.

Core.RiskyHost.reasons.status string

The incident status.

Core.RiskyHost.reasons.points number

The score.

getRiskyUsers

---

Retrieves the risk score of a specific user, or the users with the highest risk scores in the environment.

Arguments

Argument Name	Description	Required
user_id	Unique ID of a specific user. User ID could be either of the foo/dummy format, or just dummy.	Optional
limit	Limit the number of users that will appear in the list. (limit should be used when no specific host is requested). Default is 10.	Optional

Outputs

Core.RiskyUser.type string

Form of identification element.

Core.RiskyUser.id string

Identification value of the type field.

Core.RiskyUser.score number

The score assigned to the user.

Core.RiskyUser.norm_risk_score number

The normalized risk score of the user.

Core.RiskyUser.reasons.date created string

Date when the incident was created.

Core.RiskyUser.reasons.description string

Description of the incident.

Core.RiskyUser.reasons.severity string

The severity of the incident.

Core.RiskyUser.reasons.status string

The incident status.

Core.RiskyUser.reasons.points number

The score.

Core.RiskyUser.risk_level string

The risk level of the user.

Core.RiskyUser.email string

The email address of the user.