Networks, devices, and sensors · GraphQL type

NetworkPrefix type

A specific IP address together with its subnet prefix length (e.g. 192.168.1.23/24) on one Network. Prefixes are recorded from the addresses configured on endpoint Interface objects and link to the ArpTableEntry, Device, OpenPort, and Service objects that use the address. Because a prefix is scoped to its Network, the same address on two different networks is two distinct prefixes, so each observation traces to the exact network and host address where it was made.

Fields

Field Name Description
id - ID! The NetworkPrefix's unique identifier on the security graph.
orgId - OrganizationId! Unique identifier that corresponds to your deployment of this product or a specific customer account.
seen - SeenOnline! Describes when this NetworkPrefix was seen online.
objectType - GraphObjectType! The type of this graph object.
objectTypeLabel - String! A localized label describing the object type.
displayName - String! A concise human-friendly identifier for this object suitable for display in user interface page titles and in AI chat responses that refer to the object.
firstSeen - Time! Time this object was first seen.
lastSeen - Time! Time this object was last seen.
createdAt - Time! The time this object was created in the security graph.
updatedAt - Time! The time this object was last mutated in the security graph.
snapshotInfo - GraphObjectSnapshotInfo! Whether this object is a point-in-time snapshot of an object's state rather than the object's live state, and when that state was observed.
prefix - IpNetwork! The IP network address and prefix length in CIDR notation.
isNetworkAddress - Boolean! Whether this prefix is the network address (all host bits are zero).
isHostAddress - Boolean! Whether the address has host bits set, identifying a specific host within its subnet (e.g. 192.168.1.5/24) rather than the subnet itself.
network - Network The Network this NetworkPrefix is found on.
arpTableEntries - ArpTableEntryConnection! ARP table entries that map to this NetworkPrefix.

Arguments

limit - Int

Maximum number of results to return.

skip - Int

Number of results to skip.
interfaces - InterfaceConnection! Interfaces this NetworkPrefix is configured on.

Arguments

limit - Int

Maximum number of results to return.

skip - Int

Number of results to skip.
ports - OpenPortConnection! OpenPorts found on IPs within this NetworkPrefix.

Arguments

limit - Int

Maximum number of results to return.

skip - Int

Number of results to skip.
seenOnDevices - DeviceConnection! Devices this NetworkPrefix has been seen as configured on. When timeRange is null the last 30 days will be returned. When timeRange is specified all entries seen in the time range are returned.

Arguments

limit - Int

Maximum number of results to return.

skip - Int

Number of results to skip.

timeRange - DateTimeRangeInput

Optional time range filter.

includeSeen - Boolean

When true, the payload will include information about when the edge was seen in the relationship. The data set will be limited to the time range specified in the timeRange field. If includeSeen is true and timeRange is null then seen data for the default 7 day time range will be returned.
seenOnInterfaces - InterfaceConnection! Interfaces this NetworkPrefix has been seen as configured on. When timeRange is null the last 30 days will be returned. When timeRange is specified all entries seen in the time range are returned.

Arguments

limit - Int

Maximum number of results to return.

skip - Int

Number of results to skip.

timeRange - DateTimeRangeInput

Optional time range filter.

includeSeen - Boolean

When true, the payload will include information about when the edge was seen in the relationship. The data set will be limited to the time range specified in the timeRange field. If includeSeen is true and timeRange is null then seen data for the default 7 day time range will be returned.
services - ServiceConnection! Services found on IPs within this NetworkPrefix.

Arguments

limit - Int

Maximum number of results to return.

skip - Int

Number of results to skip.
findings - FindingsPayload! Policy findings for this object.

Arguments

limit - Int

Maximum number of results to return.

skip - Int

Number of results to skip.
issues - IssuesPayload! Policy issues for this object.

Arguments

limit - Int

Maximum number of results to return.

skip - Int

Number of results to skip.
issuesSummary - IssuesSummary! Summary of the active policy issues currently open on this object, broken down by severity.

Returned by

  • networkPrefix query: Retrieves a NetworkPrefix by its graph object id: a host IP address with its subnet length, such as 192.168.1.23/24, on a specific Network.

Used by

  • ArpTableEntry type: One entry in an Endpoint's neighbor cache: the IPv4 Address Resolution Protocol (ARP) table and, where the operating system reports it, the IPv6…
  • Device type: A physical or virtual device that does not run the Wartiva endpoint application but is visible on the network to a managed Endpoint, such as…
  • OpenPort type: One TCP or UDP port at one IP address on a discovered Device, found by managed endpoints port-scanning the devices on their local networks and by…
  • Service type: A network service identified on a discovered Device: one protocol (such as HTTP, TLS, SSH, SMB, DNS, SNMP, IPP, mDNS, or UPnP) acting as a client or…
  • DeviceIpNetwork type: An IP prefix containing an IP address and CIDR mask that a Device was seen using.
  • GraphObjectType enum: An enumeration of the different types of security graph objects.
  • GraphObjectTypeCategory enum: High-level grouping used to organize GraphObjectType values in UI navigation and API discovery.
  • NetworkPrefixConnection type: Collection payload for NetworkPrefix edges with total count.
  • NetworkPrefixEdge type: Edge payload for a NetworkPrefix.
  • NetworkPrefixPayload type: Payload wrapper for a single NetworkPrefix result.

Related types

  • Device A physical or virtual device that does not run the Wartiva endpoint application but is visible on the network to a managed Endpoint, such as…
  • Network An IP network (subnet) that a managed Endpoint has been attached to, identified by its address range in CIDR notation and, for networks outside a…
  • OpenPort One TCP or UDP port at one IP address on a discovered Device, found by managed endpoints port-scanning the devices on their local networks and by…
  • Service A network service identified on a discovered Device: one protocol (such as HTTP, TLS, SSH, SMB, DNS, SNMP, IPP, mDNS, or UPnP) acting as a client or…

Example

Example

{
  "id": "4",
  "orgId": "615f3b3b28284380e28a7342",
  "seen": SeenOnline,
  "objectType": "ACCOUNT_POLICY",
  "objectTypeLabel": "xyz789",
  "displayName": "xyz789",
  "firstSeen": "2021-10-07T18:23:25.829Z",
  "lastSeen": "2021-10-07T18:23:25.829Z",
  "createdAt": "2021-10-07T18:23:25.829Z",
  "updatedAt": "2021-10-07T18:23:25.829Z",
  "snapshotInfo": GraphObjectSnapshotInfo,
  "prefix": IpNetwork,
  "isNetworkAddress": false,
  "isHostAddress": true,
  "network": Network,
  "arpTableEntries": ArpTableEntryConnection,
  "interfaces": InterfaceConnection,
  "ports": OpenPortConnection,
  "seenOnDevices": DeviceConnection,
  "seenOnInterfaces": InterfaceConnection,
  "services": ServiceConnection,
  "findings": FindingsPayload,
  "issues": IssuesPayload,
  "issuesSummary": IssuesSummary
}