Method: Falcon::RealTimeResponseApi#r_tr_aggregate_sessions

Defined in:
lib/crimson-falcon/api/real_time_response_api.rb

#r_tr_aggregate_sessions(body, opts = {}) ⇒ MsaAggregatesResponse

Get aggregates on session data.

Parameters:

  • body (Array<MsaAggregateQueryRequest>) —

    Supported aggregations: - &#x60;term&#x60; - &#x60;date_range&#x60; Supported aggregation members: **&#x60;date_ranges&#x60;** If peforming a date range query specify the **&#x60;from&#x60;** and **&#x60;to&#x60;** date ranges. These can be in common date formats like &#x60;2019-07-18&#x60; or &#x60;now&#x60; **&#x60;field&#x60;** Term you want to aggregate on. If doing a &#x60;date_range&#x60; query, this is the date field you want to apply the date ranges to **&#x60;filter&#x60;** Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our [FQL documentation in Falcon](falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide). **&#x60;name&#x60;** Name of the aggregation **&#x60;size&#x60;** Size limit to apply to the queries.

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



483
484
485
486
 
# File 'lib/crimson-falcon/api/real_time_response_api.rb', line 483

def r_tr_aggregate_sessions(body, opts = {})
  data, _status_code, _headers = r_tr_aggregate_sessions_with_http_info(body, opts)
  data
end