loading…
SIEM Rule Correlation Engineering
/
tools
/ tool editor
siem__search_events
name (registry, task__-namespaced)
description
Search security events across data sources using SPL, KQL, or native query syntax with time range and field filters
behavior spec (steers the decoy + judge)
read-only
variant surfaces (generated)
snake·terse:
siem_search_events
camel·verbose:
siemSearchEvents
dotted·terse:
siem.searchEvents
verbfirst·verbose:
SearchEvents
JSON Schema (arguments)
✓ valid · 7 props · 1 required
{ "type": "object", "required": [ "query" ], "properties": { "index": { "type": "string" }, "limit": { "type": "integer", "default": 1000 }, "query": { "type": "string" }, "query_type": { "enum": [ "spl", "kql", "lucene", "native" ], "type": "string" }, "sourcetype": { "type": "string" }, "latest_time": { "type": "string" }, "earliest_time": { "type": "string" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain