Tables

A table is a dataset defined by a Hamelin query that materializes its output to storage under a catalog name you choose. The name may be top-level or schema-qualified. The resource id is prefixed TBL_.

A table reads from a source and lands typed columns as a persisted dataset that the rest of the platform can query. Its output feeds views, unions, mappers, and detections downstream.

Variants

A table comes in three variants, fixed at creation and determined by the query.

• An ingest table parses raw connector events into structured fields. Its query reads only connectors.
• A continuous table derives incrementally from other datasets, the same machinery a deployed detection uses to materialize its signals. Its query reads no connectors. Unlike a materialized view, a continuous table is not fully re-derived when its definition changes. See incremental queries for why.
• A static table holds rows you upload directly, from a CSV or parsed lines.

Inputs

Field	Type	Required	Description
name	string	Required	Dataset name in schema.name format, e.g. events.okta, or a single identifier.
query	string	Required	The Hamelin query that produces the table's rows. Output must contain no variant types.
tableType	enum	Required	ingest, continuous, or static. ingest parses connector events, and its query references only connectors. continuous derives incrementally from non-connector datasets. static holds uploaded rows. Resolved from the query. Default ingest.
deploy	boolean	Required	Whether the table materializes. true runs the query and writes the dataset. false leaves it as saved content.
sourceFormat	enum	Optional	Format of uploaded data for a static table: parsed_lines or csv. csv forces tableType to static. Default parsed_lines.
retentionDays	integer	Optional	Days to retain materialized rows. Null keeps the Space default.
keyColumns	array<string>	Optional	Columns forming the row key for a static table. At least one is required for a static table. Rejected for ingest and continuous. For CSV, keys are selected during the first upload.
partitioningColumn	string	Optional	Column the materialized dataset is partitioned by. Null for none.
sortedByColumn	string	Optional	Column the materialized dataset is sorted by. Null for none.
maxLatency	enum	Optional	Ceiling on how stale a continuous table's rows may be: MAX_1H (one hour) or MAX_1D (one day). Required for continuous tables. Null for other types.
startsAt	timestamp	Optional	For a continuous table, rows are only materialized for events at or after this time. Null for other types.
createCase	boolean	Optional	Whether rows from this table open a case. Default false.
archived	boolean	Optional	Whether the table is archived. Archived tables do not materialize. Default false.

Outputs

Field	Type	Description
deploymentStatus	enum	Materialization state: UNDEPLOYED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, DEPLOYED, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, FAILED, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
sortedByColumns	array<string>	Sort columns for a static table, mirrored from keyColumns. Empty for other types.
lastMaterializedAt	timestamp	When the table last materialized. Null if it never has.
fromDatasets	array<object>	The source datasets the query reads, each with name, resourceName, resourceId, and spaceId.
connectorIds	array<string>	Connectors the ingest query references, in query order.
connectorId	string	Primary connector when several exist. Retained for backward compatibility.
parserId / parserName	string	The parser that owns this table, when derived from one.
integrationId	string	The integration this table belongs to, when derived from one.
detectionId	string	The detection that derives this table, when it is a detection's signal table.
lookupId / lookupName	string	The lookup that owns this table, when derived from one.
schemaId	string	Schema resource ID this table's output conforms to. Null when unconstrained.
readOnly	boolean	true when the table cannot be edited in place, such as one owned by a detection, parser, or lookup.
isSystemCreated	boolean	true when the platform created the table rather than a user.
statusDetails	object	Data-plane status detail for the materialized dataset, when present.

Plus the common resource fields.

Related

• Connectors, the source an ingest table parses.
• Views and Unions, query-defined datasets built on table output.
• Incremental queries, how a continuous table materializes.
• Changesets, how table edits are staged and committed.
• Parse custom data, how to author and deploy an ingest table.