tie_deviances
Find AD objects with Indicators of Exposure (IoE) deviances for a checker. Filter by time window, profile, directories, or reasons to pinpoint security issues.
Instructions
Find AD objects with IoE deviances for a checker within a time window.
This is the time-filterable deviance query (server-side dateStart/dateEnd via
the checker's ad-objects/search endpoint). Provide hours for a relative
window (e.g. hours=12) or explicit date_start/date_end. With neither, defaults
to the last 24h.
Args: checker_id: IoE checker id (see resource="checkers"). profile_id: Security profile id (default 1). Note: your console may use a non-default profile — call tie_profiles to list them. directory_ids: Restrict to these directory ids (default: all directories in scope). hours: Relative look-back window in hours (e.g. 12). Ignored if date_start given. date_start: Explicit ISO 8601 UTC start (e.g. "2026-07-07T16:00:00.000Z"). date_end: Explicit ISO 8601 UTC end (default: now). reasons: Optional reason ids to filter (see /api/profiles/{id}/checkers/{id}/reasons). show_ignored: Include deviances that are currently ignored (default False). page: Page number (1-based). per_page: Results per page. verbose: If False (default), truncate giant attribute values.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| hours | No | ||
| reasons | No | ||
| verbose | No | ||
| date_end | No | ||
| per_page | No | ||
| checker_id | Yes | ||
| date_start | No | ||
| profile_id | No | ||
| show_ignored | No | ||
| directory_ids | No |