The RuleDeployment resource represents the deployment state of a Rule.
| JSON representation |
|---|
{ "name": string, "enabled": boolean, "alerting": boolean, "archived": boolean, "archiveTime": string, "runFrequency": enum ( |
| Fields | |
|---|---|
name |
Identifier. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: |
enabled |
Whether the rule is currently deployed continuously against incoming data. |
alerting |
Whether detections resulting from this deployment should be considered alerts. |
archived |
The archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and runFrequency cannot be updated. |
archiveTime |
Output only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: |
runFrequency |
The run frequency of the rule deployment. |
scheduleCustomizations |
Optional. The schedule customizations of the rule deployment. Only valid for customizable run frequencies. Note that because schedule customizations are tied to run frequency, they must be updated using the "runFrequency" update mask. There is no separate update mask value specifically for schedule customizations. |
executionState |
Output only. The execution state of the rule deployment. |
producerRules[] |
Output only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: |
consumerRules[] |
Output only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: |
lastAlertStatusChangeTime |
Output only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: |
ScheduleCustomizations
ScheduleCustomizations customize schedules for rules with customizable run frequencies.
| JSON representation |
|---|
{ "ensureEnrichmentCompleteness": boolean, "lateArrivingDataAdjustment": string } |
| Fields | |
|---|---|
ensureEnrichmentCompleteness |
Optional. Indicates whether to add additional delays and runs to rules to ensure enrichment completeness, with the trade-off of higher detection latencies. |
lateArrivingDataAdjustment |
Optional. Adjust the first rule execution run to account for late-arriving data. A duration in seconds with up to nine fractional digits, ending with ' |
ExecutionState
The possible execution states the rule deployment can be in.
| Enums | |
|---|---|
EXECUTION_STATE_UNSPECIFIED |
Unspecified or unknown execution state. |
DEFAULT |
Default execution state. |
LIMITED |
Rules in limited state may not have their executions guaranteed. |
PAUSED |
Paused rules are not executed at all. |