Signal
A signal is a detection result that records a security-relevant observation and its supporting evidence.
A deployed detection maintains its signals as a queryable dataset at
signals.<detection> and adds one signal for each query result. Signals can
serve as input to another detection, enter alert triage, or provide evidence for
a case. The signal schema
defines the fields each signal carries.
Related
- Detections, the content that produces signals.
- Write a detection, how to author and deploy a detection.
- Signals vs alerts, how signals relate to alert triage.
- Signal schema reference, the complete field set every signal carries.