{"command":{"effect":"read","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Returns each active PIR's match counts, with the same fields and filters as a single PIR's aggregate, and the number of distinct values of each field across all of them, each value counted once. Counts are not summed across PIRs: an event can match several PIRs. Drafts are left out; PIRs the matcher paused are included. A PIR whose matches cannot be counted is returned with `error` and left out of `combined`. Requires the Threat Events entitlement.","properties":{"path":{"type":"object","properties":{"account_id":{"type":"string","minLength":1}},"required":["account_id"],"additionalProperties":false},"query":{"type":"object","properties":{"aggregate_by":{"description":"Comma-separated fields to count: tags, attacker, attacker_country, target_industry, indicator, indicator_type. `indicator` is each event's primary indicator, the first one it was created with.","type":"string","maxLength":200,"minLength":1},"limit":{"description":"Top values returned per field.","type":"integer","default":10,"maximum":100,"minimum":1},"since":{"description":"Only matches first matched at or after this ISO 8601 time.","type":"string","format":"date-time"},"triage_state":{"description":"Only matches in this triage state.","type":"string","enum":["new","relevant","not_relevant"]},"include_backfill":{"description":"Include matches from the 30 days before activation. Defaults to true.","type":"string","default":"true","enum":["true","false"]}},"required":["aggregate_by"],"additionalProperties":false}},"required":["path","query"],"additionalProperties":false},"name":"Count matched events across the account's priority intelligence requirements","id":"cloudflare.get_pirallmatchaggregates","example":{"path":{"account_id":"example"},"query":{"aggregate_by":"example"}},"maxRequests":1,"summary":false}}