@@ -36257,6 +36257,12 @@ components:
3625736257 SecurityMonitoringRuleUpdatePayload:
3625836258 description: Update an existing rule.
3625936259 properties:
36260+ calculatedFields:
36261+ description: Calculated fields. Only allowed for scheduled rules - in other
36262+ words, when schedulingOptions is also defined.
36263+ items:
36264+ $ref: '#/components/schemas/CalculatedField'
36265+ type: array
3626036266 cases:
3626136267 description: Cases for generating signals.
3626236268 items:
@@ -36313,6 +36319,8 @@ components:
3631336319 items:
3631436320 $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3631536321 type: array
36322+ schedulingOptions:
36323+ $ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3631636324 tags:
3631736325 description: Tags for generated signals.
3631836326 items:
@@ -36339,6 +36347,27 @@ components:
3633936347 - $ref: '#/components/schemas/SecurityMonitoringStandardRulePayload'
3634036348 - $ref: '#/components/schemas/SecurityMonitoringSignalRulePayload'
3634136349 - $ref: '#/components/schemas/CloudConfigurationRulePayload'
36350+ SecurityMonitoringSchedulingOptions:
36351+ description: Options for scheduled rules. When this field is present, the rule
36352+ runs based on the schedule. When absent, it runs real-time on ingested logs.
36353+ nullable: true
36354+ properties:
36355+ rrule:
36356+ description: Schedule for the rule queries, written in RRULE syntax. See
36357+ [RFC](https://icalendar.org/iCalendar-RFC-5545/3-8-5-3-recurrence-rule.html)
36358+ for syntax reference.
36359+ example: FREQ=HOURLY;INTERVAL=1;
36360+ type: string
36361+ start:
36362+ description: Start date for the schedule, in ISO 8601 format without timezone.
36363+ example: '2025-07-14T12:00:00'
36364+ type: string
36365+ timezone:
36366+ description: Time zone of the start date, in the [tz database](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)
36367+ format.
36368+ example: America/New_York
36369+ type: string
36370+ type: object
3634236371 SecurityMonitoringSignal:
3634336372 description: Object description of a security signal.
3634436373 properties:
@@ -37017,6 +37046,12 @@ components:
3701737046 SecurityMonitoringStandardRuleCreatePayload:
3701837047 description: Create a new rule.
3701937048 properties:
37049+ calculatedFields:
37050+ description: Calculated fields. Only allowed for scheduled rules - in other
37051+ words, when schedulingOptions is also defined.
37052+ items:
37053+ $ref: '#/components/schemas/CalculatedField'
37054+ type: array
3702037055 cases:
3702137056 description: Cases for generating signals.
3702237057 example: []
@@ -37069,6 +37104,8 @@ components:
3706937104 items:
3707037105 $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3707137106 type: array
37107+ schedulingOptions:
37108+ $ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3707237109 tags:
3707337110 description: Tags for generated signals.
3707437111 example:
@@ -37098,6 +37135,12 @@ components:
3709837135 SecurityMonitoringStandardRulePayload:
3709937136 description: The payload of a rule.
3710037137 properties:
37138+ calculatedFields:
37139+ description: Calculated fields. Only allowed for scheduled rules - in other
37140+ words, when schedulingOptions is also defined.
37141+ items:
37142+ $ref: '#/components/schemas/CalculatedField'
37143+ type: array
3710137144 cases:
3710237145 description: Cases for generating signals.
3710337146 example: []
@@ -37158,6 +37201,8 @@ components:
3715837201 items:
3715937202 $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3716037203 type: array
37204+ schedulingOptions:
37205+ $ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3716137206 tags:
3716237207 description: Tags for generated signals.
3716337208 example:
@@ -37214,6 +37259,14 @@ components:
3721437259 example: false
3721537260 readOnly: true
3721637261 type: boolean
37262+ index:
37263+ description: '**This field is currently unstable and might be removed in
37264+ a minor version upgrade.**
37265+
37266+ The index to run the query on, if the `dataSource` is `logs`. Only used
37267+ for scheduled rules - in other words, when the `schedulingOptions` field
37268+ is present in the rule payload.'
37269+ type: string
3721737270 metric:
3721837271 deprecated: true
3721937272 description: '(Deprecated) The target field to aggregate over when using
@@ -37241,6 +37294,12 @@ components:
3724137294 SecurityMonitoringStandardRuleResponse:
3724237295 description: Rule.
3724337296 properties:
37297+ calculatedFields:
37298+ description: Calculated fields. Only allowed for scheduled rules - in other
37299+ words, when schedulingOptions is also defined.
37300+ items:
37301+ $ref: '#/components/schemas/CalculatedField'
37302+ type: array
3724437303 cases:
3724537304 description: Cases for generating signals.
3724637305 items:
@@ -37326,6 +37385,8 @@ components:
3732637385 items:
3732737386 $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3732837387 type: array
37388+ schedulingOptions:
37389+ $ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3732937390 tags:
3733037391 description: Tags for generated signals.
3733137392 items:
@@ -37357,6 +37418,12 @@ components:
3735737418 SecurityMonitoringStandardRuleTestPayload:
3735837419 description: The payload of a rule to test
3735937420 properties:
37421+ calculatedFields:
37422+ description: Calculated fields. Only allowed for scheduled rules - in other
37423+ words, when schedulingOptions is also defined.
37424+ items:
37425+ $ref: '#/components/schemas/CalculatedField'
37426+ type: array
3736037427 cases:
3736137428 description: Cases for generating signals.
3736237429 example: []
@@ -37409,6 +37476,8 @@ components:
3740937476 items:
3741037477 $ref: '#/components/schemas/SecurityMonitoringReferenceTable'
3741137478 type: array
37479+ schedulingOptions:
37480+ $ref: '#/components/schemas/SecurityMonitoringSchedulingOptions'
3741237481 tags:
3741337482 description: Tags for generated signals.
3741437483 example:
0 commit comments