Activity Log Event FilterAlert/Alert

Alert event for a filter alert

Field NameTypeValueAvailabilityDescription
alertId    Alert ID; only for filter alerts
alertName    Alert name
@id    A unique identifier for the event. Can be used to refer to and re-find specific events.
@ingesttimestamp    The timestamp of when the event was ingested. The value is milliseconds-since-epoch.
@rawstring    The original text of the event. As it keeps the original data on ingestion, this field allows you to do free-text searching across all logs and to extract virtual fields in queries.
@timestamp    Timestamp in milliseconds since the epoch (1st Jan 1970, 00:00) of the ingested event, e.g. 2022-11-22 09:50:20.100 if the event has an identifiable timestamp.
@timestamp.nanos    Extended precision of timestamp below millisecond. E.g. 295000
@timezone    The timezone the event originated in, if known. This is often set when the event's timestamp is parsed.
category    Category of the event, such as Alert, Request, IngestFeed, Fdr, Query, Action, and ScheduledSearch
dataspace    Repository or view name
eventsAlreadyTriggered    For filter alerts, the number of events already triggered
eventsBeingTriggered    For filter alerts, the number of events being triggered
externalQueryId    External ID of the running query
#category    Category of the event
#repo    Name of the repo where the event is stored
#severity    Severity of the event from original log source
ingestTimeForWhichAllEventsAreTriggered    Latest time when all events with smaller @ingesttimestmp have triggered actions
ingestTimeKnownGood    Latest known ingest time for digested data
isLiveQuery    Whether or not the alert executed in the event contained a live query
message    Message of the alert or event
query    Query executed during the event
queryEnd    End of the time interval for the query
queryProcessedEvents    Number of events processed to return the final result set
queryStart    Start of the time interval for the query
severity    Severity of the event
status    Whether the alert, scheduled search, or scheduled report was successful (value Success) or failed (value Failure). An individual failure may be triggered for multiple reasons, but repeated failures over a period of time may indicate a problem that needs investigation.
subCategory    Subcategory of the event
timestamp    Timestamp in milliseconds of the event
viewId    View ID