Detections

A detection is a Hamelin query that runs continuously over one or more datasets and emits a signal each time its conditions match.

A detection reads events, usually a normalized events_ecs.{integration} dataset, and shapes each match into the signal schema. Its query can be any incremental Hamelin query: a simple per-event filter, a time-based aggregation, a sliding-window correlation, or a sliding-window ordered correlation. When you deploy a detection, it derives a continuous Table that materializes its signals incrementally, and each signal can open an alert. A detection's id is prefixed DET_. See Write a detection for how to author, validate, and deploy one.

Inputs

Field	Type	Required	Description
name	string	Required	Detection name.
description	string	Optional	Free-text documentation, typically Markdown.
query	string	Required	The Hamelin query that produces signals. Must not be empty to commit.
type	enum	Required	Correlation type: QUERY or SCENARIO. Only QUERY is supported. Default QUERY.
level	enum	Required	Detection severity classification: INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL. Default LOW.
maturity	enum	Required	Lifecycle stage: EXPERIMENTAL, TEST, STABLE, DEPRECATED. Default EXPERIMENTAL.
maximumLatency	enum	Required	Ceiling on how stale materialized signals may be: MAX_1H (one hour) or MAX_1D (one day). Default MAX_1H. Sets the refresh cadence of the derived Table.
deploy	boolean	Required	Whether the detection is live. true derives and materializes the signal Table. false leaves it as saved content.
createCase	boolean	Optional	Whether signals from this detection open a case. Default false. A signal with signal.skip_alert set to true stays in its dataset and does not enter triage.
startsAt	timestamp	Optional	Signals are only generated for events at or after this time. Defaults to the detection's creation time.
retentionDays	integer	Optional	Days to retain materialized signals. Null keeps the Space default.
responseInstructions	string	Optional	Guidance for triage agents evaluating alerts from this detection.
minimumPriority	integer	Optional	Priority floor for alerts from this detection. When set, alerts always escalate to at least this priority. Null disables the floor.
accumulationKey	array<string>	Optional	Signal field paths to group by when accumulating signals into one alert. Null disables accumulation. Accepts top-level fields (message, timestamp, tags, labels, event, detection) and dot-notation nested paths (labels.<key>, event.<field>, detection.<field>). A multi-segment path must resolve to a scalar leaf.
archived	boolean	Optional	Whether the detection is archived. Archived detections do not run. Default false.
folderPath	string	Optional	Folder location within the Space, e.g. Detections/AWS.

Outputs

Field	Type	Description
folderId	string	Resource ID of the folder, or null when the detection is not in a folder.
deploymentStatus	enum	Materialization state of the derived signal Table: UNDEPLOYED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, DEPLOYED, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, FAILED, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
table	object	The derived signal Table when deployed. Carries its id (TBL_), status, and lastMaterializedAt.
installedFromPack	object	Present when the detection was installed from a content pack.
readOnly	boolean	true when the detection cannot be edited in place, such as one installed from a content pack.

Plus the common resource fields.

Related

• Signal schema reference, the fields a detection query writes.
• Signals vs alerts, how signals become alerts.
• Tables, the continuous Table a deployed detection derives.
• Write a detection, how to author, validate, and deploy one.