Drift by Simulation Status

Returns drift analysis for simulations’ statuses/results in a window.

Filters:

It is highly recommended to use a narrow time window and apply filters, as it can significantly improve response time.

• windowStart (string, ISO-8601 in UTC (e.g., 2025-10-24T00:00:00.000Z), optional): Start of time window. Default: 7 days before windowEnd.
• windowEnd (string, ISO-8601 in UTC (e.g., 2025-10-24T00:00:00.000Z), optional): End of time window. Default: now.
• earliestSearchTime (number|string, optional): Earliest time to search per tracking ID. Default: 30 days before windowStart.
• maxOutsideWindowExecutions (integer >= 0, optional): Simulations to include before windowStart per tracking ID. Default: 1.
• attackId (integer, optional): Filter by a specific attack or move ID (query-level filter).
• attackName (string, optional): Filter by attack name (query-level filter). Must be non-empty.
• attackType (string, optional): Filter by attack type display name (for example, “Malware Drop”). Query-level filter. Must be non-empty.
• driftType (enum, optional): Improvement | Regression | NotApplicable

Status filters (choose ONE pair type):

A) Final status:

• fromFinalStatus / toFinalStatus (enum): prevented | stopped | detected | logged | missed | inconsistent

B) Simple status:

• fromStatus / toStatus (enum): FAIL | SUCCESS

Mutual exclusion:

• If you set fromFinalStatus/toFinalStatus, do NOT set fromStatus/toStatus (and vice-versa).