POST /siem/milestone_statistics

Retrieves milestone filter statistics with distinct values and counts

Retrieves predefined filter fields with distinct values fetched from the milestone database table along with their corresponding counts. Returns fixed filter fields where each filter contains distinct values from the database, and each value includes the count of items. All filter fields are always present in the response, even if they contain no data (in which case an empty list is returned). Performance Optimization: This endpoint uses POST method to implement a temporary table strategy for optimal performance:

Creates a temporary table with filtered milestone data
Performs GROUP BY and aggregation operations on the isolated dataset
Deletes the temporary table after completion

This approach significantly improves performance for large datasets by reducing lock contention on the main offense_milestones table and enabling faster aggregation operations. Filter Behavior:

When filter parameter is provided in the request body, the API applies framework services filtering logic on milestone data
When searchFilter parameter is provided in the request body, the API performs case-insensitive partial matching on the specified filter field values using LIKE operator
The fields header parameter acts as an output filter, specifying which filter fields to include in the response
Fields used in searchFilter or filter parameters are automatically excluded from the response, even if explicitly listed in the fields header
If the fields header is not provided, all filter fields are returned by default (except those used in searchFilter or filter parameters)

Table 1. POST /siem/milestone_statistics resource details
MIME Type
application/json

Table 2. POST /siem/milestone_statistics request parameter details
Parameter	Type	Optionality	Data Type	MIME Type	Description
Range	header	Optional	String	text/plain	Optional - Use this parameter to restrict the number of elements that are returned in the list to a specified range. The list is indexed starting at zero.
fields	header	Optional	String	text/plain	Optional - Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas.

Table 3. POST /siem/milestone_statistics request body details
Parameter	Data Type	MIME Type	Description	Sample
requestData	Object	application/json	Required. The request body containing offense_id and optional filter/searchFilter parameters.	{ "offense_id": 123, "filter": "rule IN ('RULE-1000') AND url LIKE ('malicious')" }

Table 4. POST /siem/milestone_statistics response codes
HTTP Response Code	Unique Code	Description
200		The milestone filter statistics were retrieved successfully.
403	1012	Attack Timeline feature is disabled.
404	1000	Offense with specified ID not found.
422	1001	Invalid request parameters (offense_id required, must be positive, invalid filter/searchFilter syntax).
422	1002	null
422	1003	null
422	1004	null
422	1005	null
500	1020	An error occurred during processing.

Response Description

MilestoneFiltersResponseDTO object. The response object contains the following fields:

offense_id - Long - The ID of the offense for which these statistics were generated.
filter - String - Optional. The filter expression that was applied to generate these statistics. This echoes back the filter parameter from the request body.
searchFilter - String - Optional. The search filter expression that was applied to generate these statistics. This echoes back the searchFilter parameter from the request body.
milestone_trigger - Array - Array of value/count objects for milestone trigger types. Each element contains:
- value - String - The trigger type (e.g., "Source IP", "Destination IP", "Rule", "Log Source/Flow Source", "QID Event/Flow Name").
- count - Integer - The number of milestones with this trigger type.
milestone_type - Array - Array of value/count objects for milestone types. Each element contains:
- value - String - The milestone type (e.g., "Event", "Flow").
- count - Integer - The number of milestones of this type.
source_ip - Array - Array of value/count objects for source IP addresses. Each element contains:
- value - String - The source IP address.
- count - Integer - The number of milestones with this source IP.
destination_ip - Array - Array of value/count objects for destination IP addresses. Each element contains:
- value - String - The destination IP address.
- count - Integer - The number of milestones with this destination IP.
username - Array - Array of value/count objects for usernames. Each element contains:
- value - String - The username.
- count - Integer - The number of milestones associated with this username.
rule - Array - Array of value/count objects for rules. Each element contains:
- value - String - The rule name.
- count - Integer - The number of milestones triggered by this rule.
mitre_tactics - Array - Array of value/count objects for MITRE ATT&CK tactics. Each element contains:
- value - String - The MITRE tactic name.
- count - Integer - The number of milestones associated with this tactic.
mitre_techniques - Array - Array of value/count objects for MITRE ATT&CK techniques. Each element contains:
- value - String - The MITRE technique name.
- count - Integer - The number of milestones associated with this technique.
event_flow_name - Array - Array of value/count objects for event/flow names. Each element contains:
- value - String - The event or flow name.
- count - Integer - The number of milestones with this event/flow name.
hostname - Array - Array of value/count objects for hostnames. Each element contains:
- value - String - The hostname.
- count - Integer - The number of milestones associated with this hostname.
filename - Array - Array of value/count objects for filenames. Each element contains:
- value - String - The filename.
- count - Integer - The number of milestones associated with this filename.
filehash - Array - Array of value/count objects for file hashes. Each element contains:
- value - String - The file hash.
- count - Integer - The number of milestones associated with this file hash.
url - Array - Array of value/count objects for URLs (only available via explicit search using searchFilter). Each element contains:
- value - String - The URL.
- count - Integer - The number of milestones associated with this URL.
source_mac - Array - Array of value/count objects for source MAC addresses. Each element contains:
- value - String - The source MAC address.
- count - Integer - The number of milestones with this source MAC address.
destination_mac - Array - Array of value/count objects for destination MAC addresses. Each element contains:
- value - String - The destination MAC address.
- count - Integer - The number of milestones with this destination MAC address.
lower_level_category - Array - Array of value/count objects for lower level categories. Each element contains:
- value - String - The lower level category ID.
- count - Integer - The number of milestones in this category.
logsource - Array - Array of value/count objects for log sources. Each element contains:
- value - String - The log source name.
- count - Integer - The number of milestones from this log source.

Response Sample


{
    "destination_ip": [
        {
            "count": 42,
            "value": "String"
        }
    ],
    "destination_mac": [
        {
            "count": 42,
            "value": "String"
        }
    ],
    "event_flow_name": [
        {
            "count": 42,
            "id": "String",
            "value": "String"
        }
    ],
    "file_hash": [
        {
            "count": 42,
            "value": "String"
        }
    ],
    "file_name": [
        {
            "count": 42,
            "value": "String"
        }
    ],
    "filter": "String",
    "filtered_milestones_count": 42,
    "flow_source": [
        {
            "count": 42,
            "id": "String",
            "value": "String"
        }
    ],
    "hostname": [
        {
            "count": 42,
            "value": "String"
        }
    ],
    "log_source": [
        {
            "count": 42,
            "id": "String",
            "value": "String"
        }
    ],
    "low_level_category": [
        {
            "count": 42,
            "id": "String",
            "value": "String"
        }
    ],
    "milestone_trigger": [
        {
            "count": 42,
            "value": "String"
        }
    ],
    "milestone_type": [
        {
            "count": 42,
            "value": "String"
        }
    ],
    "offense_id": 42,
    "rule": [
        {
            "count": 42,
            "id": "String",
            "value": "String"
        }
    ],
    "source_ip": [
        {
            "count": 42,
            "value": "String"
        }
    ],
    "source_mac": [
        {
            "count": 42,
            "value": "String"
        }
    ],
    "url": [
        {
            "count": 42,
            "value": "String"
        }
    ],
    "username": [
        {
            "count": 42,
            "value": "String"
        }
    ]
}