window.percentile

Supported in:
window.percentile(values, percentile)

Description

This function returns the specified percentile of the input values.

The percentile is a number between 0 and 100.

Param data types

INT|FLOAT, INT

Return type

FLOAT

Code samples

This example returns the median (50th percentile) of the values in the match window.

// This rule creates a detection when the median file size in 5 minutes for a user is over a threshold.
events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p50 = window.percentile($e.file.size, 50) // yields 2.0 if the event file size values in the match window are 1, 2, and 3.
condition:
  $e and $p50 > 10