You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: IDs of reference datasets used by this query.
37564
+
items:
37565
+
description: Dataset ID.
37566
+
type: string
37567
+
type: array
37547
37568
distinctFields:
37548
37569
description: Field for which the cardinality is measured. Sent as an array.
37549
37570
items:
@@ -37561,6 +37582,15 @@ components:
37561
37582
description: When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values.
37562
37583
example: false
37563
37584
type: boolean
37585
+
index:
37586
+
description: Index used to load the data for this query.
37587
+
type: string
37588
+
indexes:
37589
+
description: Indexes used to load the data for this query. Mutually exclusive with `index`.
37590
+
items:
37591
+
description: Index name.
37592
+
type: string
37593
+
type: array
37564
37594
metrics:
37565
37595
description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.
37566
37596
items:
@@ -37574,6 +37604,9 @@ components:
37574
37604
description: Query to run on logs.
37575
37605
example: a > 3
37576
37606
type: string
37607
+
queryLanguage:
37608
+
description: Language used to parse the query string.
37609
+
type: string
37577
37610
type: object
37578
37611
HistoricalJobResponse:
37579
37612
description: Historical job response.
@@ -37607,6 +37640,10 @@ components:
37607
37640
modifiedAt:
37608
37641
description: Last modification time of the job.
37609
37642
type: string
37643
+
progressRate:
37644
+
description: Job execution progress as a value between 0 and 1. Omitted for finished jobs.
37645
+
format: double
37646
+
type: number
37610
37647
signalOutput:
37611
37648
description: Whether the job outputs signals.
37612
37649
type: boolean
@@ -43137,9 +43174,10 @@ components:
43137
43174
$ref: "#/components/schemas/CalculatedField"
43138
43175
type: array
43139
43176
cases:
43140
-
description: Cases used for generating job results.
43177
+
description: Cases used for generating job results. Up to 10 cases are allowed.
description: Starting time of data analyzed by the job.
@@ -43169,9 +43207,10 @@ components:
43169
43207
options:
43170
43208
$ref: "#/components/schemas/HistoricalJobOptions"
43171
43209
queries:
43172
-
description: Queries for selecting logs analyzed by the job.
43210
+
description: Queries for selecting logs analyzed by the job. Up to 10 queries are allowed.
43173
43211
items:
43174
43212
$ref: "#/components/schemas/HistoricalJobQuery"
43213
+
maxItems: 10
43175
43214
type: array
43176
43215
referenceTables:
43177
43216
description: Reference tables used in the queries.
@@ -43185,10 +43224,11 @@ components:
43185
43224
type: string
43186
43225
type: array
43187
43226
thirdPartyCases:
43188
-
description: Cases for generating results from third-party detection method. Only available for third-party detection method.
43227
+
description: Cases for generating results from third-party detection method. Only available for third-party detection method. Up to 10 cases are allowed.
description: Ending time of data analyzed by the job.
@@ -43210,6 +43250,12 @@ components:
43210
43250
JobDefinitionFromRule:
43211
43251
description: Definition of a historical job based on a security monitoring rule.
43212
43252
properties:
43253
+
caseIndex:
43254
+
description: Zero-based index of the rule case to use as the job's signal condition. When omitted, all cases are evaluated. Up to 10 cases are supported, so valid values are 0 to 9.
43255
+
format: int32
43256
+
maximum: 9
43257
+
minimum: 0
43258
+
type: integer
43213
43259
from:
43214
43260
description: Starting time of data analyzed by the job.
0 commit comments