# Data Security

# Content Findings

## Top integrations by content findings

`analytics_query.data_security.content_findings.top_n(ContentFindingTopNParams**kwargs)  -> SyncSinglePage[ContentFindingTopNResponse]`

**post** `/accounts/{account_id}/analytics/query/data-security/content-findings/top-n`

Returns the top N integrations ranked by total content findings.

### Parameters

- `account_id: str`

- `filters: Iterable[Filter]`

  Filters to apply. `findingType = content` is applied automatically for CASB data.

  - `name: str`

    Specifies the column name to filter on. Requires a valid column for the target dataset (e.g. `country`, `allowed`, `appId`).

  - `op: str`

    Filter operator. Common values: `eq`, `neq`, `in`, `not_in`, `gt`, `lt`, `gte`, `lte`.

  - `values: Sequence[Union[str, bool, float]]`

    Values to match against. Type depends on the column.

    - `str`

    - `bool`

    - `float`

- `from_: Union[str, datetime]`

  Start of the query time range (inclusive). RFC3339.

- `n: int`

  Maximum number of integrations to return.

- `to: Union[str, datetime]`

  End of the query time range (exclusive). RFC3339.

### Returns

- `Dict[str, object]`

  Maps field names to values. Keys represent stat names and group-by column names. Values depend on the dataset (strings, numbers, booleans).

### Example

```python
import os
from datetime import datetime
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
page = client.analytics_query.data_security.content_findings.top_n(
    account_id="023e105f4ecef8ad9ca31a8372d0c353",
    filters=[],
    from_=datetime.fromisoformat("2024-11-01T00:00:00"),
    n=10,
    to=datetime.fromisoformat("2024-11-08T00:00:00"),
)
page = page.result[0]
print(page)
```

#### Response

```json
{
  "errors": [],
  "messages": [
    {
      "code": 1000,
      "message": "API in beta: expect breaking changes."
    }
  ],
  "result": [
    {
      "integrationId": "123e4567-e89b-12d3-a456-426614174000",
      "integrationName": "Google Workspace",
      "total": 42
    },
    {
      "integrationId": "223e4567-e89b-12d3-a456-426614174001",
      "integrationName": "Microsoft 365",
      "total": 17
    }
  ],
  "success": true
}
```

## Domain Types

### Content Finding Top N Response

- `Dict[str, object]`

  Maps field names to values. Keys represent stat names and group-by column names. Values depend on the dataset (strings, numbers, booleans).

# Findings

## Data security findings summary

`analytics_query.data_security.findings.summary(FindingSummaryParams**kwargs)  -> FindingSummaryResponse`

**post** `/accounts/{account_id}/analytics/query/data-security/findings/summary`

Returns aggregate current-period and previous-period totals for CASB findings.

### Parameters

- `account_id: str`

- `filters: Iterable[Filter]`

  Filters to apply.

  - `name: str`

    Specifies the column name to filter on. Requires a valid column for the target dataset (e.g. `country`, `allowed`, `appId`).

  - `op: str`

    Filter operator. Common values: `eq`, `neq`, `in`, `not_in`, `gt`, `lt`, `gte`, `lte`.

  - `values: Sequence[Union[str, bool, float]]`

    Values to match against. Type depends on the column.

    - `str`

    - `bool`

    - `float`

- `from_: Union[str, datetime]`

  Start of the query time range (inclusive). RFC3339.

- `to: Union[str, datetime]`

  End of the query time range (exclusive). RFC3339.

### Returns

- `class FindingSummaryResponse: …`

  - `current_total: List[Dict[str, object]]`

    Aggregated stats for the requested time range.

  - `previous_total: List[Dict[str, object]]`

    Aggregated stats for the equivalent preceding time range, for trend comparison.

### Example

```python
import os
from datetime import datetime
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
response = client.analytics_query.data_security.findings.summary(
    account_id="023e105f4ecef8ad9ca31a8372d0c353",
    filters=[],
    from_=datetime.fromisoformat("2024-11-01T00:00:00"),
    to=datetime.fromisoformat("2024-11-08T00:00:00"),
)
print(response.current_total)
```

#### Response

```json
{
  "errors": [],
  "messages": [
    {
      "code": 1000,
      "message": "API in beta: expect breaking changes."
    }
  ],
  "result": {
    "currentTotal": [
      {
        "findingProduct": "Cloud",
        "findingType": "Content",
        "findingsTotal": 48291
      },
      {
        "findingProduct": "SaaS",
        "findingType": "Posture",
        "findingsTotal": 1205
      }
    ],
    "previousTotal": [
      {
        "findingProduct": "Cloud",
        "findingType": "Content",
        "findingsTotal": 41033
      },
      {
        "findingProduct": "SaaS",
        "findingType": "Posture",
        "findingsTotal": 982
      }
    ]
  },
  "success": true
}
```

## Data security findings timeseries

`analytics_query.data_security.findings.timeseries(FindingTimeseriesParams**kwargs)  -> FindingTimeseriesResponse`

**post** `/accounts/{account_id}/analytics/query/data-security/findings/timeseries`

Returns merged time-bucketed CASB findings.

### Parameters

- `account_id: str`

- `filters: Iterable[Filter]`

  Filters to apply.

  - `name: str`

    Specifies the column name to filter on. Requires a valid column for the target dataset (e.g. `country`, `allowed`, `appId`).

  - `op: str`

    Filter operator. Common values: `eq`, `neq`, `in`, `not_in`, `gt`, `lt`, `gte`, `lte`.

  - `values: Sequence[Union[str, bool, float]]`

    Values to match against. Type depends on the column.

    - `str`

    - `bool`

    - `float`

- `from_: Union[str, datetime]`

  Start of the query time range (inclusive). RFC3339.

- `to: Union[str, datetime]`

  End of the query time range (exclusive). RFC3339.

### Returns

- `class FindingTimeseriesResponse: …`

  Merged CASB and CDE findings timeseries result.

  - `slots: List[Dict[str, object]]`

    Contains time-bucketed result rows. Each slot includes a `timestamp` plus `content` and `posture` maps with `cloud` and `saas` keys.

  - `resolution: Optional[str]`

    Always null for this endpoint.

### Example

```python
import os
from datetime import datetime
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
response = client.analytics_query.data_security.findings.timeseries(
    account_id="023e105f4ecef8ad9ca31a8372d0c353",
    filters=[],
    from_=datetime.fromisoformat("2024-11-01T00:00:00"),
    to=datetime.fromisoformat("2024-11-08T00:00:00"),
)
print(response.slots)
```

#### Response

```json
{
  "errors": [],
  "messages": [
    {
      "code": 1000,
      "message": "API in beta: expect breaking changes."
    }
  ],
  "result": {
    "slots": [
      {
        "content": {
          "cloud": 150,
          "saas": 23
        },
        "posture": {
          "cloud": 0,
          "saas": 5
        },
        "timestamp": "2024-11-05T00:00:00Z"
      },
      {
        "content": {
          "cloud": 180,
          "saas": 30
        },
        "posture": {
          "cloud": 0,
          "saas": 7
        },
        "timestamp": "2024-11-06T00:00:00Z"
      }
    ]
  },
  "success": true
}
```

## Domain Types

### Finding Summary Response

- `class FindingSummaryResponse: …`

  - `current_total: List[Dict[str, object]]`

    Aggregated stats for the requested time range.

  - `previous_total: List[Dict[str, object]]`

    Aggregated stats for the equivalent preceding time range, for trend comparison.

### Finding Timeseries Response

- `class FindingTimeseriesResponse: …`

  Merged CASB and CDE findings timeseries result.

  - `slots: List[Dict[str, object]]`

    Contains time-bucketed result rows. Each slot includes a `timestamp` plus `content` and `posture` maps with `cloud` and `saas` keys.

  - `resolution: Optional[str]`

    Always null for this endpoint.