gnql-timeseries-stats
Track scanning and attack trends by retrieving the count of unique IPs matching a GNQL query over time, aggregated per hour or day.
Instructions
Get the number of unique IPs matching a GNQL query per hour/day over a time range (Recall Stats).
Returns aggregated counts of unique IPs per time bucket, useful for trend analysis and understanding how scanning/attack activity changes over time.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | GNQL query string | |
| interval | Yes | Time bucket interval ('hour' or 'day') | |
| start_time | No | Start of time range (ISO 8601 format) | |
| end_time | No | End of time range (ISO 8601 format) |