Resource
A resource is the unit the whole of Perpetual is arranged around. Every concept you work with, a detection, a Space, a case, a user, is a resource.
Perpetual has three surfaces you reach it through: the web app, the API, and the MCP server. Underneath all three sits the resource model. A resource represents one application concept and holds its fields. The web app renders resources, the API exposes them, and the MCP server lets an outside agent act on them, but in every case you are working with resources first. The surface is how you reach a resource. The resource is the thing itself.
You do not create a "resource" directly. You create a detection, a table, a role. Each is a resource kind. This page documents what every kind has in common. Each kind's own page documents what is specific to it.
Common fields
Every resource carries the same envelope of fields, whatever its kind. A kind's own page lists only the fields specific to that kind and links here for these.
| Field | Type | Description |
|---|---|---|
id | string | Resource ID. Unique and stable for the life of the resource. Each kind uses its own prefix, such as DET_ for a detection or SPC_ for a Space. |
name | string | The resource's name, unique within its kind and scope. |
version | integer | Monotonic version, incremented on each committed edit. |
organizationId | string | The organization the resource belongs to, prefixed ORG_. |
spaceId | string | The Space the resource belongs to, prefixed SPC_, for the kinds that are Space-scoped. |
changesetId | string | The changeset holding an uncommitted edit to the resource. Null once committed. |
deleted | boolean | true when the resource is marked deleted within a changeset. Default false. |
createdAt | timestamp | When the resource was created. |
updatedAt | timestamp | When the resource was last modified. |
createdByUserId | string | The user who created the resource, prefixed USR_. Null when the actor was not a user. |
updatedByUserId | string | The user who last edited the resource, prefixed USR_. Null when the actor was not a user. |
Not every kind carries every field. An organization and a
user are not Space-scoped, so they have no spaceId. A kind that is
not versioned through a changeset omits changesetId and deleted. Each kind's
page states the fields it actually has.
Resource kinds
The resource kinds you reach through the Perplexicon, grouped by what they do.
Identity and access
- User, a person's identity.
- Organization, the top-level tenant.
- Role, a named grant of access.
Content
The authored, version-controlled resources you build. See Content for the category and its shared mechanics.
- Spaces, Folders, Changesets, and Content packs.
- Content: detections, dashboards, integrations, parsers, mappers, lookups, webhooks, credentials, HTTP tools, MCP servers, and skills.
Datasets
The queryable data. See Dataset resources for the category.
- Connectors, Tables, Views, and Unions.
Investigation
- Cases, the container for investigating and responding to signals.
- Chats, a conversation with the Simba agent.
- Threat reports, a security artifact the platform produces.
Infrastructure
- Data plane, the deployed engine that ingests, materializes, and queries datasets.
Related
- Organizations, the tenant every resource belongs to.
- Changesets, how edits to a resource are staged and committed.
- Content and Dataset resources, the two category indexes that group most kinds.