query xdrStories ( $accountID:ID! $storyInput:StoryInput!) {
	xdr ( accountID:$accountID ) {
		stories ( input:$storyInput  )  {
			paging {
				from
				limit
				total
			}
			items {
				id
				accountId
				analystName
				analystEmail
				accountName
				updatedAt
				createdAt
				playbook
				summary
				incident {
					id
					firstSignal
					lastSignal
					engineType
					vendor
					producer
					producerName
					connectionType
					indication
					queryName
					criticality
					source
					ticket
					status
					research
					siteName
					storyDuration
					description
					sourceIp
					analystFeedback {
						verdict
						severity
						threatType {
							name
							recommendedAction
							details
						}
						threatClassification
						additionalInfo
					}
					site {
						id
						name
					}
					user {
						id
						name
					}
					predictedVerdict
					predictedThreatType
					categories
					entities {
						ref {
							id
							name
							... on ThreatClassificationRef {
								id
								name
							}
							... on ThreatTypeRef {
								id
								name
							}
							... on AllowlistRuleRef {
								id
								name
							}
							... on ResponsePolicyRuleRef {
								id
								name
							}
							... on UnknownEntityRef {
								id
								name
							}
							... on UserRef {
								id
								name
							}
							... on UsersGroupRef {
								id
								name
							}
							... on DeviceProfileRef {
								id
								name
							}
							... on PrivateApplicationRef {
								id
								name
							}
							... on AdminRef {
								id
								name
							}
							... on ApiKeyRef {
								id
								name
							}
							... on CustomCategoryRef {
								id
								name
							}
							... on GroupRef {
								id
								name
							}
							... on RbacRoleRef {
								id
								name
							}
							... on AccessTokenRef {
								id
								name
							}
							... on AllocatedIpRef {
								id
								name
							}
							... on DhcpRelayGroupRef {
								id
								name
							}
							... on FloatingSubnetRef {
								id
								name
							}
							... on GlobalRangeRef {
								id
								name
							}
							... on HostRef {
								id
								name
							}
							... on NetworkInterfaceRef {
								id
								name
							}
							... on SiteRef {
								id
								name
							}
							... on AccountRef {
								id
								name
							}
							... on SiteNetworkSubnetRef {
								id
								name
							}
							... on ApplicationRef {
								id
								name
							}
							... on ApplicationCategoryRef {
								id
								name
							}
							... on SanctionedAppsCategoryRef {
								id
								name
							}
							... on CloudApplicationRef {
								id
								name
							}
							... on CustomApplicationRef {
								id
								name
							}
							... on ServiceRef {
								id
								name
							}
							... on SimpleServiceRef {
								id
								name
							}
							... on CountryRef {
								id
								name
							}
							... on InterfaceSubnetRef {
								id
								name
							}
							... on SubscriptionGroupRef {
								id
								name
							}
							... on SubscriptionWebhookRef {
								id
								name
							}
							... on SubscriptionMailingListRef {
								id
								name
							}
							... on SystemGroupRef {
								id
								name
							}
							... on GlobalIpRangeRef {
								id
								name
							}
							... on StringValueSetRef {
								id
								name
							}
							... on ApplicationControlActivityRef {
								id
								name
							}
							... on ApplicationControlActivityFieldRef {
								id
								name
							}
							... on ApplicationControlCriterionRef {
								id
								name
							}
							... on ApplicationControlContentTypeRef {
								id
								name
							}
							... on ApplicationControlContentTypeGroupRef {
								id
								name
							}
							... on DlpContentProfileRef {
								id
								name
							}
							... on DlpEdmProfileRef {
								id
								name
							}
							... on BandwidthManagementRef {
								id
								name
							}
							... on PopLocationRef {
								id
								name
							}
							... on FqdnContainerRef {
								id
								name
							}
							... on IpAddressRangeContainerRef {
								id
								name
							}
							... on ContainerRef {
								id
								name
							}
							... on LocationRef {
								id
								name
							}
							... on InvoiceRef {
								id
								name
							}
							... on UserNotificationTemplateRef {
								id
								name
							}
							... on ApplicationConnectorCatalogEntityRef {
								id
								name
							}
							... on ZtnaAppConnectorRef {
								id
								name
							}
							... on PopLocationMachineRef {
								id
								name
							}
							... on PopLocationServiceUnitRef {
								id
								name
							}
							... on GroupMemberRefTyped {
								id
								name
								type
							}
							... on InternetFirewallPolicyRef {
								id
								name
							}
							... on WanFirewallPolicyRef {
								id
								name
							}
							... on AiSecurityDataProfileRef {
								id
								name
							}
							... on AiSecurityGuardRef {
								id
								name
							}
						}
						type
						role
						kind
						data {
							fieldName
							values
						}
					}
					tags
					... on MicrosoftEndpoint {
						id
						firstSignal
						lastSignal
						engineType
						vendor
						producer
						producerName
						connectionType
						indication
						queryName
						source
						criticality
						ticket
						status
						research
						siteName
						storyDuration
						description
						sourceIp
						analystFeedback
						site
						user
						similarStoriesData
						predictedVerdict
						predictedThreatType
						categories
						entities
						tags
						device
						alerts
					}
					... on AnomalyStats {
						id
						firstSignal
						lastSignal
						engineType
						vendor
						producer
						producerName
						connectionType
						indication
						queryName
						source
						criticality
						ticket
						status
						research
						siteName
						storyDuration
						description
						analystFeedback
						site
						user
						sourceIp
						similarStoriesData
						predictedVerdict
						predictedThreatType
						categories
						entities
						tags
						srcSiteId
						os
						deviceName
						macAddress
						logonName
						clientClass
						drillDownFilter
						breakdownField
						subjectType
						extra
						gaussian
						metric
						metricDetails
						mitres
						rules
						timeSeries
						targets
						direction
					}
					... on AnomalyEvents {
						id
						firstSignal
						lastSignal
						engineType
						vendor
						producer
						producerName
						connectionType
						indication
						queryName
						source
						criticality
						ticket
						status
						research
						siteName
						storyDuration
						description
						analystFeedback
						site
						user
						sourceIp
						similarStoriesData
						predictedVerdict
						predictedThreatType
						categories
						entities
						tags
						srcSiteId
						os
						deviceName
						macAddress
						logonName
						clientClass
						drillDownFilter
						breakdownField
						subjectType
						extra
						gaussian
						metric
						metricDetails
						mitres
						rules
						timeSeries
						targets
						direction
					}
					... on Threat {
						id
						firstSignal
						lastSignal
						engineType
						vendor
						producer
						producerName
						connectionType
						indication
						queryName
						source
						criticality
						ticket
						status
						research
						siteName
						storyDuration
						description
						analystFeedback
						site
						user
						similarStoriesData
						predictedVerdict
						predictedThreatType
						categories
						entities
						tags
						srcSiteId
						flowsCardinality
						riskLevel
						os
						deviceName
						macAddress
						sourceIp
						logonName
						direction
						clientClass
						events
						mitres
						timeSeries
						targets
						flows
					}
					... on ThreatPrevention {
						id
						firstSignal
						lastSignal
						engineType
						vendor
						producer
						producerName
						connectionType
						indication
						queryName
						source
						criticality
						ticket
						status
						research
						siteName
						storyDuration
						description
						analystFeedback
						site
						user
						similarStoriesData
						predictedVerdict
						predictedThreatType
						categories
						entities
						tags
						srcSiteId
						flowsCardinality
						riskLevel
						os
						deviceName
						macAddress
						sourceIp
						logonName
						direction
						clientClass
						events
						mitres
						timeSeries
						targets
						threatPreventionsEvents
					}
					... on NetworkXDRIncident {
						id
						firstSignal
						lastSignal
						engineType
						vendor
						producer
						producerName
						connectionType
						indication
						queryName
						source
						criticality
						ticket
						status
						research
						siteName
						storyDuration
						description
						sourceIp
						analystFeedback
						site
						user
						similarStoriesData
						predictedVerdict
						predictedThreatType
						categories
						entities
						tags
						networkIncidentTimeline
						storyType
						occurrences
						siteConnectionType
						siteConfigLocation
						acknowledged
						linkId
						linkName
						linkConfigPrecedence
						deviceConfigHaRole
						licenseRegion
						licenseBandwidth
						pop
						isp
						bgpConnection
						hostIp
						ruleName
						muted
						ilmmDetails
					}
					... on AiOperationsIncident {
						id
						firstSignal
						lastSignal
						engineType
						vendor
						producer
						producerName
						connectionType
						indication
						queryName
						criticality
						ticket
						status
						research
						storyDuration
						description
						analystFeedback
						site
						user
						similarStoriesData
						predictedVerdict
						predictedThreatType
						flowLastTime
						flowStartTime
						source
						ioa
						riskScore
						sourceIp
						siteName
						categories
						entities
						tags
						type
						occurrences
						eventsGraphQuery
						accountOperationIncident
					}
					... on GenericIncident {
						id
						firstSignal
						lastSignal
						engineType
						vendor
						producer
						producerName
						connectionType
						indication
						queryName
						criticality
						source
						ticket
						status
						research
						siteName
						storyDuration
						description
						sourceIp
						analystFeedback
						site
						user
						similarStoriesData
						predictedVerdict
						predictedThreatType
						categories
						entities
						tags
						vendorInfo
						statusInfo
						evidences
						queries
						mitres
					}
					... on CatoEndpoint {
						id
						firstSignal
						lastSignal
						engineType
						vendor
						producer
						producerName
						connectionType
						indication
						queryName
						source
						criticality
						ticket
						status
						research
						siteName
						storyDuration
						description
						sourceIp
						analystFeedback
						site
						user
						similarStoriesData
						predictedVerdict
						predictedThreatType
						categories
						entities
						tags
						device
						alerts
					}
				}
				timeline {
					createdAt
					description
					context
					type
					descriptions
					category
					additionalInfo
					analystInfo {
						name
						email
					}
				}
			}
		}
	}	
}