WanguardInstall

Summary

Retrieve multiple anomaly records from the Wanguard system with optional filtering and sorting criteria.

Inputs

• filters — Collection of optional filters to narrow down anomalies by status, sensor interface name, prefix, IP group, direction, decoder name, unit, domain, comparison, classification, time range (from/until as Unix timestamp or ISO 8601), threshold template ID, IP zone ID, response ID, and comments.
• options — Additional options including specific fields to return (empty returns only href), sorting order, count-only mode, result limit, and offset to paginate results.

Output shape

a list of anomaly objects or a count of anomalies if count-only is set

The result can be filtered and sorted as configured. If the 'count only' option is enabled, the output will include only the count of matching anomalies instead of full records. Otherwise, each anomaly record will include requested fields or only href if no fields are specified.

Examples

Example 1: Fetch active anomalies filtered by classification and limited to 10 results

Filters set with Status='Active', Classification='Verified Attack'; Options set with Limit=10, Fields including anomaly_id, status, classification

Example 2: Get count of anomalies detected from a specific sensor interface

Filters set with Sensor Interface Name containing a substring; Options set with Count Only=true