InputsUsed(mapping=None, *, ignore_unknown_fields=False, **kwargs)InputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
Attributes |
|
|---|---|
| Name | Description |
uses_udm |
bool
Optional. Whether the rule queries UDM events. |
uses_entity |
bool
Optional. Whether the rule queries entity events. |
uses_detection |
bool
Optional. Whether the rule queries detections. |