Drift by Security Control

Use this endpoint to query tracking IDs whose status transitions match specific drift patterns within a defined time window. It is designed for detection and mitigation workflows, allowing you to isolate regressions or improvements, scope results by a security control, and control how strictly transitions are matched (contains vs. starts/ends).

Filters:

It is highly recommended to use a narrow time window and apply filters, as this can significantly improve response time and reduce payload size.

• securityControl (string, required): The security control to scan.
• windowStart (string, ISO-8601 UTC, optional): Start of the search window. Default is 7 days before windowEnd.
• windowEnd (string, ISO-8601 UTC, optional): End of the search window. Default is now.
• earliestSearchTime (string, ISO-8601 UTC, optional): Earliest time to search before windowStart per tracking ID. Default is 30 days before windowStart. Strongly recommended to narrow this to improve performance under heavy load.
• maxOutsideWindowExecutions (integer ≥ 0, optional): Number of executions outside the window to include per tracking ID for context. Default is 1. Reducing this improves performance and response size
• fromStatus / toStatus (optional): Define the specific status transition to match.
• attackId (integer, optional): Filter by a specific attack or move ID (query-level filter).
• attackName (string, optional): Filter by attack name (query-level filter). Must be non-empty.
• attackType (string, optional): Filter by attack type display name (for example, “Malware Drop”). Query-level filter. Must be non-empty.
• driftType (enum, optional): Filter by drift type, such as regression, improvement, or mixedDrift.
• containsTransition (boolean, optional): Match if the specified transition appears anywhere in the execution sequence.
• startsAndEndsWithTransition (boolean, optional): Match only if the execution starts with fromStatus and ends with toStatus.

Notes:

• containsTransition and startsAndEndsWithTransition are mutually exclusive. Only one may be set to true.
• All timestamps must be in ISO-8601 UTC format (for example: 2025-10-24T00:00:00.000Z).