Skip to main content
POST
Preview custom detection matches

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
sourceTable
string
required

SIEM 2.0 source table for the WHERE predicate

query
string
required

WHERE predicate to validate against the source table

Response

data
object[]
required

Sample rows returned by the custom detection scan in the last hour

count
number
required

Total sample rows returned (must be fewer than 100)

queryTimeMs
number
required

Preview query execution time in milliseconds

rowsRead
number
required

Rows scanned while evaluating the preview

bytesRead
number
required

Bytes scanned while evaluating the preview