{"command":{"effect":"read","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Aggregate threat indicators by one or more columns (e.g., indicatorType, value) across datasets. Returns top-N groups ordered by count.","properties":{"path":{"type":"object","properties":{"account_id":{"description":"Account ID.","type":"string"}},"required":["account_id"],"additionalProperties":false},"query":{"type":"object","properties":{"aggregateBy":{"description":"Column(s) to aggregate by - single column or comma-separated list (e.g., 'indicatorType', 'value', 'indicatorType,value')","type":"string"},"measure":{"description":"What to count per group: 'indicators' (catalog rows, default) or 'relationships' (linked events per indicator). Use 'relationships' for 'top indicator by event activity'.","type":"string","default":"indicators","enum":["indicators","relationships"]},"tagUuid":{"description":"Scope to indicators associated with this tag/actor UUID. Combine with measure=relationships for 'top indicator for an actor'.","type":"string"},"datasetIds":{"description":"Dataset UUIDs to filter by, or one standalone scope value: 'operational' for readable intelligence datasets (isAnalytics=false), 'analytics' for readable analytics datasets (isAnalytics=true), or 'all'/'*' for every readable dataset including analytics datasets. If not provided, aggregates across all accessible datasets, including analytics datasets.","type":"array","items":{"type":"string"}},"createdAfter":{"description":"Filter indicators created after this date/datetime (ISO 8601, e.g., '2024-01-01' or '2024-01-01T00:00:00Z')","anyOf":[{"format":"date-time","type":"string"},{"pattern":"^\\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\\d|3[01])$","type":"string"}]},"createdBefore":{"description":"Filter indicators created before this date/datetime (ISO 8601, e.g., '2024-12-31' or '2024-12-31T23:59:59Z')","anyOf":[{"format":"date-time","type":"string"},{"pattern":"^\\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\\d|3[01])$","type":"string"}]},"eventDateAfter":{"description":"For measure=relationships: only count indicator→event links whose relationship was created/observed on or after this date (ISO 8601). Bounds the activity view to recently-observed links. Note: this filters by the relationship's createdAt (link-observation time), not the underlying event's business date.","type":"string"},"eventDateBefore":{"description":"For measure=relationships: only count indicator→event links whose relationship was created/observed on or before this date (ISO 8601). Bounds the activity view by the relationship's createdAt (link-observation time), not the underlying event's business date.","type":"string"},"limit":{"description":"Maximum number of aggregation results to return (1-100)","type":"number","default":10,"maximum":100,"minimum":1}},"required":["aggregateBy"],"additionalProperties":false}},"required":["path","query"],"additionalProperties":false},"name":"Aggregate indicators by column(s)","id":"cloudflare.get_indicatoraggregate","example":{"path":{"account_id":"example"},"query":{"aggregateBy":"example"}},"maxRequests":1,"summary":false}}