Class SecurityMonitoringStandardRuleQuery

A container for additional, undeclared properties. This is a holder for any undeclared properties as specified with the 'additionalProperties' keyword in the OAS document.

The aggregation type.

Query extension to append to the logs query.

Source of events, either logs, audit trail, or Datadog events.

Field for which the cardinality is measured. Sent as an array.

Fields to group by.

When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with N/A, replacing the missing values.

This field is currently unstable and might be removed in a minor version upgrade. The index to run the query on, if the dataSource is logs. Only used for scheduled rules - in other words, when the schedulingOptions field is present in the rule payload.

List of indexes to query when the dataSource is logs. Only used for scheduled rules, such as when the schedulingOptions field is present in the rule payload.

(Deprecated) The target field to aggregate over when using the sum or max aggregations. metrics field should be used instead.

Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values.

Name of the query.

Query to run on logs.