Class StateChange (1.18.2)

StateChange(value)

The change in state of the finding.

When querying across two points in time this describes the change in the finding between the two points: CHANGED, UNCHANGED, ADDED, or REMOVED. Findings can not be deleted, so REMOVED implies that the finding at timestamp does not match the filter specified, but it did at timestamp - compare_duration. If there was no compare_duration supplied in the request the state change will be: UNUSED

Values: UNUSED (0): State change is unused, this is the canonical default for this enum. CHANGED (1): The finding has changed state in some way between the points in time and existed at both points. UNCHANGED (2): The finding has not changed state between the points in time and existed at both points. ADDED (3): The finding was created between the points in time. REMOVED (4): The finding at timestamp does not match the filter specified, but it did at timestamp - compare_duration.