Get case statistics by category class
curl --request POST \
--url https://api.wirespeed.co/v1/cases/stats/category-class \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"size": 123,
"page": 123,
"filter": "<string>",
"search": "<string>",
"orderBy": "<string>",
"days": 123,
"startDate": "<string>",
"endDate": "<string>",
"statuses": [],
"assetId": "<string>",
"exclusionId": "<string>",
"onlyWasEscalated": true,
"onlyWasContained": true,
"onlyWasMobile": true,
"onlyWasMonitored": true,
"onlyChatOps": true,
"hideDemoClients": true,
"createdAt": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"groupIds": [
"<string>"
]
}
'import requests
url = "https://api.wirespeed.co/v1/cases/stats/category-class"
payload = {
"size": 123,
"page": 123,
"filter": "<string>",
"search": "<string>",
"orderBy": "<string>",
"days": 123,
"startDate": "<string>",
"endDate": "<string>",
"statuses": [],
"assetId": "<string>",
"exclusionId": "<string>",
"onlyWasEscalated": True,
"onlyWasContained": True,
"onlyWasMobile": True,
"onlyWasMonitored": True,
"onlyChatOps": True,
"hideDemoClients": True,
"createdAt": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"groupIds": ["<string>"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
size: 123,
page: 123,
filter: '<string>',
search: '<string>',
orderBy: '<string>',
days: 123,
startDate: '<string>',
endDate: '<string>',
statuses: [],
assetId: '<string>',
exclusionId: '<string>',
onlyWasEscalated: true,
onlyWasContained: true,
onlyWasMobile: true,
onlyWasMonitored: true,
onlyChatOps: true,
hideDemoClients: true,
createdAt: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
groupIds: ['<string>']
})
};
fetch('https://api.wirespeed.co/v1/cases/stats/category-class', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.wirespeed.co/v1/cases/stats/category-class",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'size' => 123,
'page' => 123,
'filter' => '<string>',
'search' => '<string>',
'orderBy' => '<string>',
'days' => 123,
'startDate' => '<string>',
'endDate' => '<string>',
'statuses' => [
],
'assetId' => '<string>',
'exclusionId' => '<string>',
'onlyWasEscalated' => true,
'onlyWasContained' => true,
'onlyWasMobile' => true,
'onlyWasMonitored' => true,
'onlyChatOps' => true,
'hideDemoClients' => true,
'createdAt' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'groupIds' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.wirespeed.co/v1/cases/stats/category-class"
payload := strings.NewReader("{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"exclusionId\": \"<string>\",\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"onlyWasMobile\": true,\n \"onlyWasMonitored\": true,\n \"onlyChatOps\": true,\n \"hideDemoClients\": true,\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.wirespeed.co/v1/cases/stats/category-class")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"exclusionId\": \"<string>\",\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"onlyWasMobile\": true,\n \"onlyWasMonitored\": true,\n \"onlyChatOps\": true,\n \"hideDemoClients\": true,\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.wirespeed.co/v1/cases/stats/category-class")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"exclusionId\": \"<string>\",\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"onlyWasMobile\": true,\n \"onlyWasMonitored\": true,\n \"onlyChatOps\": true,\n \"hideDemoClients\": true,\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body[
{
"categoryClass": "<string>",
"displayName": "<string>",
"count": 123,
"totalCount": 123,
"percentage": 123
}
]Cases
Get case statistics by category class
POST
/
v1
/
cases
/
stats
/
category-class
Get case statistics by category class
curl --request POST \
--url https://api.wirespeed.co/v1/cases/stats/category-class \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"size": 123,
"page": 123,
"filter": "<string>",
"search": "<string>",
"orderBy": "<string>",
"days": 123,
"startDate": "<string>",
"endDate": "<string>",
"statuses": [],
"assetId": "<string>",
"exclusionId": "<string>",
"onlyWasEscalated": true,
"onlyWasContained": true,
"onlyWasMobile": true,
"onlyWasMonitored": true,
"onlyChatOps": true,
"hideDemoClients": true,
"createdAt": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"groupIds": [
"<string>"
]
}
'import requests
url = "https://api.wirespeed.co/v1/cases/stats/category-class"
payload = {
"size": 123,
"page": 123,
"filter": "<string>",
"search": "<string>",
"orderBy": "<string>",
"days": 123,
"startDate": "<string>",
"endDate": "<string>",
"statuses": [],
"assetId": "<string>",
"exclusionId": "<string>",
"onlyWasEscalated": True,
"onlyWasContained": True,
"onlyWasMobile": True,
"onlyWasMonitored": True,
"onlyChatOps": True,
"hideDemoClients": True,
"createdAt": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"groupIds": ["<string>"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
size: 123,
page: 123,
filter: '<string>',
search: '<string>',
orderBy: '<string>',
days: 123,
startDate: '<string>',
endDate: '<string>',
statuses: [],
assetId: '<string>',
exclusionId: '<string>',
onlyWasEscalated: true,
onlyWasContained: true,
onlyWasMobile: true,
onlyWasMonitored: true,
onlyChatOps: true,
hideDemoClients: true,
createdAt: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
groupIds: ['<string>']
})
};
fetch('https://api.wirespeed.co/v1/cases/stats/category-class', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.wirespeed.co/v1/cases/stats/category-class",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'size' => 123,
'page' => 123,
'filter' => '<string>',
'search' => '<string>',
'orderBy' => '<string>',
'days' => 123,
'startDate' => '<string>',
'endDate' => '<string>',
'statuses' => [
],
'assetId' => '<string>',
'exclusionId' => '<string>',
'onlyWasEscalated' => true,
'onlyWasContained' => true,
'onlyWasMobile' => true,
'onlyWasMonitored' => true,
'onlyChatOps' => true,
'hideDemoClients' => true,
'createdAt' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'groupIds' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.wirespeed.co/v1/cases/stats/category-class"
payload := strings.NewReader("{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"exclusionId\": \"<string>\",\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"onlyWasMobile\": true,\n \"onlyWasMonitored\": true,\n \"onlyChatOps\": true,\n \"hideDemoClients\": true,\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.wirespeed.co/v1/cases/stats/category-class")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"exclusionId\": \"<string>\",\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"onlyWasMobile\": true,\n \"onlyWasMonitored\": true,\n \"onlyChatOps\": true,\n \"hideDemoClients\": true,\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.wirespeed.co/v1/cases/stats/category-class")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"exclusionId\": \"<string>\",\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"onlyWasMobile\": true,\n \"onlyWasMonitored\": true,\n \"onlyChatOps\": true,\n \"hideDemoClients\": true,\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body[
{
"categoryClass": "<string>",
"displayName": "<string>",
"count": 123,
"totalCount": 123,
"percentage": 123
}
]Authorizations
Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication.
Body
application/json
Available options:
asc, desc Number of days for time-based filtering (1-365). Used by stats/widget endpoints to set the time window.
Start date (inclusive, ISO8601 string)
End date (inclusive, ISO8601 string)
Filter cases by status
Available options:
PREFLIGHT, NEW, PROCESSING, ESCALATED, HUNTING, MONITORING, CHATOPS, CLOSED Filter cases by verdict
Available options:
MALICIOUS, SUSPICIOUS, BENIGN Filter cases involving a specific asset
Filter cases by severity
Available options:
INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL Filter cases by asset type
Available options:
USER, PROCESS, USER_AGENT, FILE, ENDPOINT, LOCATION, IP, DOMAIN Filter cases by exclusion rule
Only include cases that were escalated
Only include cases that were contained
Only include cases that involve mobile devices
Only include cases that had a monitor
Only include cases that involved chat ops
Filter cases by integration platform
Available options:
acronis, action1, admin-by-request, agger-labs, anthropic, aws, axonius, barracuda-cloudgen-firewall, bitwarden, box, checkpoint-firewall, checkpoint-harmony, cisco-asa, cisco-catalyst, cisco-duo, cisco-meraki, cisco-secure-access, cisco-secure-endpoint, cisco-umbrella, cloudflare, connectwise-psa, crowdstrike-falcon, cursor, cyberark, darktrace, darktrace-email-security, datto-edr, dfir-iris, email, exium, fleet-dm, fortianalyzer, fortinet, freshservice, generic-json, generic-syslog, github, github-enterprise-cloud, google-alert-center, google-chronicle, google-cloud-audit-logs, google-directory, google-security-center, halcyon, halo-itsm, have-i-been-pwned, horizon3, hyas-protect, ipinfo, jamf-internet-security, jamf-pro, jamf-protect, jira-cloud, jira-data-center, jumpcloud, kandji, manage-engine-ad-audit-plus, microsoft, microsoft-entra, microsoft-teams, microsoft-teams-v2, mimecast, netskope, ninjaone, odoo-helpdesk, okta, one-password, onelogin, openai, openvpn-access-server, orca-security, pager-duty, palo-alto-networks-cortex, palo-alto-ngfw, perception-point, pfsense, picus, ping-one, proofpoint, reversing-labs, safebreach, sandfly, sentinel-one, service-now, slack, sms, smtp, sonic-wall, sophos, sophos-firewall, splunk, stairwell, sublime-security, tenable-nessus, thinkst-canary, threatlocker, three-cx, tracebit, unifi, upwind, varonis-datadvantage, vectra, vmware-vsphere, watchguard-firebox, windows-event-logs, wirespeed, wiz, wordfence, zabbix, zscaler-zpa Available options:
ENDPOINT, IDENTITY, CLOUD, EMAIL, NETWORK, DATA, POSTURE, OTHER Available options:
OTHER__DIAGNOSTIC, OTHER__INFORMATIONAL_EVENT, OTHER__WARNING, OTHER__EXPERIMENTAL, OTHER__UNKNOWN, OTHER__DECEPTION, OTHER__DECEPTION__SIMULATION, OTHER__CUSTOM_DETECTION, CLOUD__INVOCATION, CLOUD__DISCOVERY, CLOUD__DATA_TRANSFER, CLOUD__PERSISTENCE, CLOUD__PUBLIC_BUCKET, ENDPOINT__DISCOVERY, ENDPOINT__EXECUTION, ENDPOINT__LIVE_OFF_THE_LAND, ENDPOINT__NUISANCE, ENDPOINT__MALWARE_DISCOVERY, ENDPOINT__MALWARE_EXECUTION, ENDPOINT__LATE_STAGE, ENDPOINT__PERSISTENCE, ENDPOINT__REMOTE_MANAGEMENT, ENDPOINT__LATERAL_MOVEMENT, ENDPOINT__IMPACT, ENDPOINT__EVASION, ENDPOINT__EXPLOITATION, ENDPOINT__SIMULATION, ENDPOINT__PLANNED_CHANGE, IDENTITY__LOGIN, IDENTITY__REJECTED_MFA, IDENTITY__DISCOVERY, IDENTITY__BRUTE_FORCE, IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE, IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE, IDENTITY__PERSISTENCE, IDENTITY__ACCOUNT_COMPROMISE, IDENTITY__OAUTH_GRANT, IDENTITY__SIMULATION, IDENTITY__PLANNED_CHANGE, NETWORK__INBOUND_CONNECTION, NETWORK__OUTBOUND_CONNECTION, NETWORK__PHISHING, NETWORK__NOISY, NETWORK__DISCOVERY, EMAIL__PHISHING, EMAIL__PHISHING_REPORTED, EMAIL__EVASION, EMAIL__MALWARE, EMAIL__MALICIOUS_LINK, EMAIL__GRAYMAIL, EMAIL__SPAM, EMAIL__BUSINESS_EMAIL_COMPROMISE, EMAIL__MAILBOX_RULE, EMAIL__CHAT, DATA__DATA_TRANSFER, DATA__DATA_SHARE, POSTURE__POSTURE, POSTURE__HEALTH Filter by creation date
Show child attributes
Show child attributes
Filter cases by group IDs (OR) — matches cases with detections whose users or endpoints belong to any of the specified groups
Response
200 - application/json
Returns case counts grouped by category class
Category class identifier
Display name for the category class
Number of cases in this category class in the selected timeframe
All-time number of cases in this category class
Percentage change from previous period