Class InputsUsed (0.1.0)

InputsUsed(mapping=None, *, ignore_unknown_fields=False, **kwargs)

InputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4

Attributes

Name Description
uses_udm bool
Optional. Whether the rule queries UDM events.
uses_entity bool
Optional. Whether the rule queries entity events.
uses_detection bool
Optional. Whether the rule queries detections.