LegacyFederatedUdmSearchViewResponse

{
  "type": enum (ErrorType),
  "error_text": string
}

{
  "time_range": {
    object (Interval)
  },
  "error_text": string
}

{
  "events": [
    {
      object (UdmEventInfo)
    }
  ],
  "column_names": {
    object (ColumnNames)
  },
  "progress": number,
  "too_many_events": boolean,
  "complete": boolean,
  "datatable_info": [
    {
      object (SearchDataTableInfo)
    }
  ]
}

{
  "event": {
    object (UDM)
  },
  "entity": {
    object (Entity)
  },
  "datatable_row_info": [
    {
      object (SearchDataTableRowInfo)
    }
  ],
  "filter_properties": {
    object (FilterProperties)
  },
  "event_log_token": string,
  "alert_number": integer,
  "display_name": string,
  "chip": {
    object (Chip)
  },
  "uid": string,
  "annotations": [
    enum (Annotation)
  ],
  "detections": [
    {
      object (Collection)
    }
  ],
  "outcomes": [
    {
      object (UdmColumnType)
    }
  ],
  "connected_component_label": string,
  "tenant_id": string
}

{
  "data_table": string,
  "rows": [
    {
      object (SearchDataTableRow)
    }
  ]
}

{
  "column": string,
  "value": string
}

{
  "string_properties": {
    string: {
      object (StringValues)
    },
    ...
  },
  "hidden": boolean
}

{
  "values": [
    {
      object (StringValue)
    }
  ]
}

{
  "raw_value": string,
  "display_value": string
}

{
  "type": enum (ChipType),
  "text": string
}

{

  // Union field type can be only one of the following:
  "value": {
    object (UdmColumnValue)
  },
  "list": {
    object (UdmColumnList)
  }
  // End of list of possible types for union field type.
}

{

  // Union field value can be only one of the following:
  "null_val": boolean,
  "bool_val": boolean,
  "bytes_val": string,
  "double_val": number,
  "int64_val": string,
  "uint64_val": string,
  "string_val": string,
  "timestamp_val": string,
  "date_val": {
    object (Date)
  },
  "proto_val": {
    "@type": string,
    field1: ...,
    ...
  }
  // End of list of possible types for union field value.
}

{
  "year": integer,
  "month": integer,
  "day": integer
}

{
  "values": [
    {
      object (UdmColumnValue)
    }
  ]
}

{
  "names": [
    string
  ]
}

{
  "data_table": string,
  "column_info": [
    {
      object (SearchDataTableColumnInfo)
    }
  ]
}

{
  "original_column": string,
  "is_default": boolean
}

{
  "fields": [
    {
      object (UdmFieldAggregation)
    }
  ],
  "group_by_fields": [
    {
      object (GroupAggregationByField)
    }
  ],
  "complete": boolean
}

{
  "field_name": string,
  "baseline_event_count": integer,
  "event_count": integer,
  "too_many_values": boolean,
  "value_count": integer,
  "all_values": [
    {
      object (UdmValueCount)
    }
  ],
  "top_values": [
    {
      object (UdmValueCount)
    }
  ],
  "bottom_values": [
    {
      object (UdmValueCount)
    }
  ],
  "aggregation_type": enum (UdmFieldAggregationType)
}

{
  "value": {
    object (UdmFieldValue)
  },
  "baseline_event_count": integer,
  "event_count": integer
}

{

  // Union field value can be only one of the following:
  "string_value": string,
  "int32_value": integer,
  "uint32_value": integer,
  "int64_value": string,
  "uint64_value": string,
  "float_value": number,
  "double_value": number,
  "enum_value": string,
  "bool_value": boolean,
  "bytes_value": string,
  "is_null": boolean,
  "timestamp_value": string
  // End of list of possible types for union field value.
}

{
  "field_name": string,
  "field_value": {
    object (UdmFieldValue)
  },
  "fields": [
    {
      object (UdmFieldAggregation)
    }
  ],
  "baseline_event_count": integer,
  "event_count": integer,
  "value_count": integer
}

{
  "rows": [
    {
      object (FunctionResponseRow)
    }
  ],
  "too_many_rows": boolean
}

{
  "values": [
    {
      object (UdmFieldValue)
    }
  ]
}

{
  "results": [
    {
      object (ColumnData)
    }
  ],
  "data_query_expression": string,
  "too_many_results": boolean,
  "total_results": integer,
  "sort_order": [
    {
      object (ColumnSort)
    }
  ]
}

{
  "column": string,
  "values": [
    {
      object (ColumnType)
    }
  ],
  "filterable": boolean,
  "filter_expression": string
}

{

  // Union field type can be only one of the following:
  "value": {
    object (ColumnValue)
  },
  "list": {
    object (List)
  }
  // End of list of possible types for union field type.
}

{

  // Union field value can be only one of the following:
  "null_val": boolean,
  "bool_val": boolean,
  "bytes_val": string,
  "double_val": number,
  "int64_val": string,
  "uint64_val": string,
  "string_val": string,
  "timestamp_val": string,
  "date_val": {
    object (Date)
  },
  "proto_val": {
    "@type": string,
    field1: ...,
    ...
  }
  // End of list of possible types for union field value.
}

{
  "values": [
    {
      object (ColumnValue)
    }
  ]
}

{
  "name": string,
  "descending": boolean
}

{
  "buckets": [
    {
      object (EventCountTimelineBucket)
    }
  ],
  "size_of_bucket_ms": string
}

{
  "baseline_event_count": integer,
  "event_count": integer,
  "baseline_alert_count": integer,
  "alert_count": integer,
  "baseline_timed_entity_count": integer,
  "filtered_timed_entity_count": integer,
  "entity_changed_count": {
    object (EntityChangedCountTimelineBucket)
  }
}

{
  "total_changed_entities_count": integer,
  "entity_changed_info": [
    {
      object (EntityChangedInfo)
    }
  ]
}

{
  "artifacts": {
    object (FieldAndValue)
  },
  "entity_count": integer
}

{
  "value": string,
  "entity_namespace": string,

  // Union field type can be only one of the following:
  "field_path": string,
  "kvalue_type": enum (KValueType)
  // End of list of possible types for union field type.
}

{
  "progress": number,
  "too_many_events": boolean,
  "complete": boolean,
  "baseline_events_count": integer,
  "filtered_events_count": integer,
  "instance_id": string,
  "timeline": {
    object (EventCountTimeline)
  },
  "detections": {
    object (Detections)
  },
  "prevalence": {
    object (UdmPrevalenceResponse)
  },
  "runtime_errors": {
    object (RuntimeError)
  }
}

{
  "detections": [
    {
      object (Collection)
    }
  ],
  "complete": boolean,
  "too_many_detections": boolean,
  "valid_snapshot_query": boolean,
  "baseline_alerts_count": integer,
  "filtered_alerts_count": integer,
  "detection_field_aggregations": {
    object (AlertFieldAggregations)
  }
}

{
  "fields": [
    {
      object (AlertFieldAggregation)
    }
  ]
}

{
  "field_name": string,
  "baseline_alert_count": integer,
  "alert_count": integer,
  "too_many_values": boolean,
  "value_count": integer,
  "all_values": [
    {
      object (AlertFieldValueCount)
    }
  ],
  "top_values": [
    {
      object (AlertFieldValueCount)
    }
  ],
  "bottom_values": [
    {
      object (AlertFieldValueCount)
    }
  ]
}

{
  "value": {
    object (AlertFieldValue)
  },
  "baseline_alert_count": integer,
  "alert_count": integer
}

{

  // Union field value can be only one of the following:
  "string_value": string,
  "int32_value": integer,
  "uint32_value": integer,
  "int64_value": string,
  "uint64_value": string,
  "float_value": number,
  "double_value": number,
  "enum_value": string,
  "bool_value": boolean,
  "bytes_value": string
  // End of list of possible types for union field value.
}

{
  "buckets": [
    {
      object (UdmPrevalenceBucket)
    }
  ],
  "partial_prevalence": boolean
}

{
  "prevalence": [
    {
      object (UdmPrevalence)
    }
  ]
}

{
  "artifacts": [
    {
      object (FieldAndValue)
    }
  ],
  "prevalence": integer
}