GNQL Timeseries Stats
gnql-timeseries-statsRetrieve hourly or daily counts of unique IPs matching a GNQL query to analyze scanning and attack activity trends over a time range.
Instructions
Get the number of unique IPs matching a GNQL query per hour/day over a time range (Recall Stats).
Returns aggregated counts of unique IPs per time bucket, useful for trend analysis and understanding how scanning/attack activity changes over time.
interval must be 'hour' or 'day'. Time bounds use ISO 8601 format.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | GNQL query string | |
| end_time | No | End of time range (ISO 8601 format) | |
| interval | Yes | Time bucket interval ('hour' or 'day') | |
| start_time | No | Start of time range (ISO 8601 format) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| max | Yes | ||
| min | Yes | ||
| data | Yes | ||
| count | Yes |