A collection of preferences for a user.
JSON representation |
---|
{
"name": string,
"ui_preferences": {
object ( |
Fields | |
---|---|
name |
Output only. Identifier. Resource name. |
ui_preferences |
Optional. Preferences for UI configuration. |
UiPreferences
Collection of preferences for UI configuration.
JSON representation |
---|
{ "display_timezone": string, "search_history": [ { object ( |
Fields | |
---|---|
display_timezone |
Optional. Timezone for displaying times to the user. |
search_history[] |
Optional. Previously run search queries. This will be limited to around 20 queries by the calling UI code. |
enable_search_history |
Optional. Flag for enabling saving search history. True if it is enabled. |
column_sets[] |
Optional. A list of ColumnSets saved by the user. |
pinned_fields[] |
Optional. A list of fields to pin at the top of the quick filters panel. |
SearchHistory
A previously run Search Query.
JSON representation |
---|
{ "query": string, "time_range": { object ( |
Fields | |
---|---|
query |
Required. The UDM Search query that was executed. |
time_range |
Optional. The time interval that the query is run over. |
execution_time |
Optional. The time the query was run. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
chronicle_owned |
Optional. Whether the saved search used is based on a saved template owned by Chronicle. |
natural_language_query |
If applicable, the natural language query used to generate the UDM Search Query. |
display_name |
If applicable, the display name of the saved search used to generate this instance. |
description |
If applicable, the description of the saved search used to generate this instance. |
search_save_time |
Optional. If applicable, the created timestamp of the saved search used to generate this instance. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
search_update_time |
Optional. If applicable, the updated timestamp of the saved search used to generate this instance. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
raw_query |
Optional. If applicable, the UDM saved search string with unreplaced placeholder names, from the saved search query used to generate this instance, e.g. "principal.hostname = $placeholder1 and target.ip = $placeholder2". |
placeholder_names[] |
Optional. If applicable, the placeholder names from the saved search used to generate this instance, e.g. ["$placeholder1", "$placeholder2"]. |
placeholder_descriptions[] |
Optional. If applicable, the placeholder descriptions from the saved search used to generate this instance, e.g. ["host", "ip"]. Each element's position corresponds to placeholder_names. |
placeholder_values[] |
Optional. If applicable, the placeholder values from the saved search to generate this instance, e.g. ["abu", "1.2.3.4"]. Each element's position corresponds to placeholder_names. |
saved_search_resource |
Optional. If applicable, the resource name of the saved search used to generate this instance. Format: |
saved_search_id |
Optional. If applicable, the id of the saved search used to generate this instance. |
sharing_mode |
Optional. If applicable, the sharing mode of the saved search used to generate this instance. |
query_type |
Optional. The query type. |
case_insensitive |
Optional. If true, the search was performed in a case-insensitive manner. |
ColumnSet
A list of UDM columns with a unique name.
JSON representation |
---|
{ "label": string, "columns": [ string ] } |
Fields | |
---|---|
label |
The name of the column set. |
columns[] |
The list of udm fields corresponding to columns. |