{"command":{"effect":"read","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Counts the PIR's matches by tag, attacker, attacker country, target industry, primary indicator, or indicator type: the top values, the number of distinct values, and the matches without a value. Covers the same matches as the matches list, in datasets the account can read now. Tags are grouped case-insensitively and shown with their most common spelling; an event counts once for each of its tags. `indicator` is the first indicator each event was created with. Field values are copied when an event matches; matches still being copied are reported in `matches.pending` and not counted, and matches whose event was already gone when its fields were copied in `matches.missing`. Counts keep the copied values, so an event deleted later stays counted. Requires the Threat Events entitlement.","properties":{"path":{"type":"object","properties":{"account_id":{"type":"string","minLength":1},"priority_id":{"type":"string","format":"uuid"}},"required":["account_id","priority_id"],"additionalProperties":false},"query":{"type":"object","properties":{"aggregate_by":{"description":"Comma-separated fields to count: tags, attacker, attacker_country, target_industry, indicator, indicator_type. `indicator` is each event's primary indicator, the first one it was created with.","type":"string","maxLength":200,"minLength":1},"limit":{"description":"Top values returned per field.","type":"integer","default":10,"maximum":100,"minimum":1},"since":{"description":"Only matches first matched at or after this ISO 8601 time.","type":"string","format":"date-time"},"triage_state":{"description":"Only matches in this triage state.","type":"string","enum":["new","relevant","not_relevant"]},"include_backfill":{"description":"Include matches from the 30 days before activation. Defaults to true.","type":"string","default":"true","enum":["true","false"]}},"required":["aggregate_by"],"additionalProperties":false}},"required":["path","query"],"additionalProperties":false},"name":"Count a priority intelligence requirement's matched events","id":"cloudflare.get_pirmatchaggregates","example":{"path":{"account_id":"example","priority_id":"00000000-0000-4000-8000-000000000000"},"query":{"aggregate_by":"example"}},"maxRequests":1,"summary":false}}