/**
 * Detections v2 documents: the batched lookup the case summary uses and the
 * QL search behind sophos_fusion_search_detections. `caseEvidence` returns
 * IDs only, so the summary resolves them here in one call.
 *
 * Operation names use the `detection*` form. The older `alertsService*`
 * aliases behave identically and are not used. Response fields still say
 * `alerts`; read them as detections. Schema: schemas/fusion/detections-v2.graphql.
 *
 * The argument on detectionRetrieveById really is spelled `iDs`. On Alert2
 * the top-level field is `priority`, not `severity`; the 0 to 1 severity
 * lives under `metadata`, and its timestamps are `{ seconds, nanos }` objects.
 */
export declare const DETECTIONS_BY_ID = "query FusionDetectionsById($in: GetByIDRequestInput!) {\n  detectionRetrieveById(in: $in) {\n    alerts {\n      total_results\n      list {\n        id\n        status\n        resolution_reason\n        attack_technique_ids\n        sensor_types\n        tags\n        metadata {\n          title\n          description\n          severity\n          confidence\n          origin\n          created_at { seconds nanos }\n          first_seen_at { seconds nanos }\n          creator { detector { detector_id detector_name } }\n        }\n        enrichment_details {\n          mitre_attack_info { technique_id technique tactics }\n        }\n        source_entities { display_name subtype identifiers }\n        target_entities { display_name subtype identifiers }\n        event_ids { id }\n      }\n    }\n  }\n}";
/**
 * The general search. detectionsV2 is not a search (it demands
 * processCorrelationID and lineageID); this is the one that takes QL, for
 * example "from alert severity >= 0.1 EARLIEST=-90d" (live tenant, 22/09/2026).
 */
export declare const DETECTION_SEARCH = "query FusionDetectionSearch($in: SearchRequestInput!) {\n  detectionSearch(in: $in) {\n    status\n    reason\n    search_id\n    alerts {\n      total_results\n      next_offset\n      list {\n        id\n        status\n        resolution_reason\n        attack_technique_ids\n        sensor_types\n        tags\n        metadata {\n          title\n          description\n          severity\n          confidence\n          origin\n          created_at { seconds nanos }\n          first_seen_at { seconds nanos }\n          creator { detector { detector_id detector_name } }\n        }\n        enrichment_details {\n          mitre_attack_info { technique_id technique tactics }\n        }\n        source_entities { display_name subtype identifiers }\n        target_entities { display_name subtype identifiers }\n        event_ids { id }\n      }\n    }\n  }\n}";
//# sourceMappingURL=detections.d.ts.map