You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: IDs of reference datasets used by this query.
38074
+
items:
38075
+
description: Dataset ID.
38076
+
type: string
38077
+
type: array
38057
38078
distinctFields:
38058
38079
description: Field for which the cardinality is measured. Sent as an array.
38059
38080
items:
@@ -38071,6 +38092,15 @@ components:
38071
38092
description: When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
38072
38093
example: false
38073
38094
type: boolean
38095
+
index:
38096
+
description: Index used to load the data for this query.
38097
+
type: string
38098
+
indexes:
38099
+
description: Indexes used to load the data for this query. Mutually exclusive with `index`.
38100
+
items:
38101
+
description: Index name.
38102
+
type: string
38103
+
type: array
38074
38104
metrics:
38075
38105
description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
38076
38106
items:
@@ -38084,6 +38114,9 @@ components:
38084
38114
description: Query to run on logs.
38085
38115
example: a > 3
38086
38116
type: string
38117
+
queryLanguage:
38118
+
description: Language used to parse the query string.
38119
+
type: string
38087
38120
type: object
38088
38121
HistoricalJobResponse:
38089
38122
description: Historical job response.
@@ -38117,6 +38150,10 @@ components:
38117
38150
modifiedAt:
38118
38151
description: Last modification time of the job.
38119
38152
type: string
38153
+
progressRate:
38154
+
description: Job execution progress as a value between 0 and 1. Available for ongoing jobs.
38155
+
format: double
38156
+
type: number
38120
38157
signalOutput:
38121
38158
description: Whether the job outputs signals.
38122
38159
type: boolean
@@ -43647,9 +43684,10 @@ components:
43647
43684
$ref: "#/components/schemas/CalculatedField"
43648
43685
type: array
43649
43686
cases:
43650
-
description: Cases used for generating job results.
43687
+
description: Cases used for generating job results. Up to 10 cases are allowed.
description: Starting time of data analyzed by the job.
@@ -43679,9 +43717,10 @@ components:
43679
43717
options:
43680
43718
$ref: "#/components/schemas/HistoricalJobOptions"
43681
43719
queries:
43682
-
description: Queries for selecting logs analyzed by the job.
43720
+
description: Queries for selecting logs analyzed by the job. Up to 10 queries are allowed.
43683
43721
items:
43684
43722
$ref: "#/components/schemas/HistoricalJobQuery"
43723
+
maxItems: 10
43685
43724
type: array
43686
43725
referenceTables:
43687
43726
description: Reference tables used in the queries.
@@ -43695,10 +43734,11 @@ components:
43695
43734
type: string
43696
43735
type: array
43697
43736
thirdPartyCases:
43698
-
description: Cases for generating results from third-party detection method. Only available for third-party detection method.
43737
+
description: Cases for generating results from third-party detection method. Only available for third-party detection method. Up to 10 cases are allowed.
description: Ending time of data analyzed by the job.
@@ -43720,6 +43760,12 @@ components:
43720
43760
JobDefinitionFromRule:
43721
43761
description: Definition of a historical job based on a security monitoring rule.
43722
43762
properties:
43763
+
caseIndex:
43764
+
description: Zero-based index of the rule case to use as the job's signal condition. When omitted, all cases are evaluated. Up to 10 cases are supported, so valid values are 0 to 9.
43765
+
format: int32
43766
+
maximum: 9
43767
+
minimum: 0
43768
+
type: integer
43723
43769
from:
43724
43770
description: Starting time of data analyzed by the job.
0 commit comments