Deployable content
Deployable content is authored content that defines or groups processing logic Perpetual can make live.
Parsers, mappers, lookups, and
detections are the four deployable content resource types.
Integrations belong in this category as the grouping resource
for parsers and mappers. Each integration owns the
composite view that its mappers build and has
no deploy field. Each of the four deployable resource types produces or
contributes to an associated dataset when its
deploy field is true.
Shared mechanics
You can author and commit any of the four deployable resource types while
deploy is false. Setting deploy to true in a
changeset makes the processing logic live when the changeset
commits. The data plane creates or updates the associated
dataset asynchronously after the commit.
A newly deployed resource has no queryable dataset until its deployment state
reaches DEPLOYED. After you commit a change to a deployed resource, queries
continue to use the previous version until the data plane applies the new
version.
Associated datasets
Each deployable resource type has the following associated dataset:
| Deployable resource type | Associated dataset |
|---|---|
| Parser | Ingest table (events.<integration>_<parser>) |
| Mapper | Shared integration composite view (events_ecs.<integration>) |
| Detection | Continuous signal table (signals.<detection>) |
| Lookup | Static table or materialized view (lookups.<lookup>) |
Resource types
- Integrations group the parsers and mappers for one source and own the composite ECS view that their deployed mappers build.
- Parsers ingest source events into typed event tables.
- Mappers normalize parsed fields into shared ECS names.
- Detections materialize matching events as signals.
- Lookups provide keyed reference datasets for enrichment.
Related
- Content, the umbrella for deployable content, other authored resources, and their supporting structures.
- Deploy, the
deployfield and its deployment states. - Dataset resources, the queryable results deployable content produces.
- Data flow, how parsers, mappers, and detections form Perpetual's processing path.