The Perplexicon

The Perplexicon is your lexicon for curing perplexity about Perpetual: the complete, lookup-optimized description of every resource in the product. Use it as a glossary. Nothing here is meant to be read front to back. Every page is below, alphabetically. Find the thing by its name and go.

A

• Alert triage agents
• Alerts

B

• Background agents

C

• Case investigation agents
• Cases
• Changesets
• Chat
• Connectors
• Content
• Content engineering agent
• Content packs
• Content work item
• Credentials

D

• Dashboards
• Data plane
• Dataset resources
• Deploy
• Deployable content
• Detection opportunity
• Detections

E

• ECS field reference

F

• Folders

H

• Hamelin
• HTTP Tools

I

• Integrations

L

• Lookups

M

• Mappers
• MCP Servers

O

• OAuth
• Organizations

P

• Parsers

R

• Resource
• Role

S

• Signal
• Signal schema reference
• Skills
• Spaces

T

• Tables
• Threat intelligence agents
• Threat report

U

• Unions
• User

V

• Views
• Visualization agents

W

• Webhooks

What lives elsewhere

• Concepts (/concepts/) explain why Perpetual works as it does.
• Guides (/guides/) provide the steps for completing a task.
• Connector Setup (/setup-docs/) is the per-connector setup instructions, one page per built-in source a connector is built from.
• MCP access (/mcp/) is the Model Context Protocol server an outside agent drives Perpetual through, with the reference for every tool it registers.
• The Hamelin language reference (hamelin.sh) is the query language many resources are written in. This reference names where a Hamelin query field goes. The language itself is documented there.