The type of input to generate the proposed rule from: natural_language for a
plain-English description of the behavior to detect, spl for a Splunk SPL search or
saved search definition, or kql for a Microsoft KQL query. SPL inputs must be
self-contained, with search macros expanded.
The type of input to generate the proposed rule from:
natural_languagefor a plain-English description of the behavior to detect,splfor a Splunk SPL search or saved search definition, orkqlfor a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded.