Devo SOAR - filterBaselineTableByTime

Read all data from the baseline whose specified column (or batch start/end time) falls within the specified dates. Compare with filterBaselineTable, which filters batches by intervals relative to the most recent batch.

The fourth argument is optional: if specified, it is the name of the column to use to perform the filtering. If it is missing, then we return all the data from the batches whose start/end time intersect with the boundaries.

Note: this operator is not a generic operator that works on any type of data, it uses specific data (table) that is generated by the baseline playbook.

Note: BatchStartTime is automatically calculated based on the time-frame in the playbook or the stream time-frame. Also, the off-set is in milliseconds so simply add 3 zero's to the second number to get milliseconds.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter the Filter Baseline Table by Time operator in the search field and select the operator from the Results to open the operator form.
3. In the Select Baseline drop-down, enter or select the baseline to pull data from.
4. Optional fields
   • Start Time: Enter an offset time or a specific start time to pull the data from. Offset time
     allows you to set time in seconds, minutes, hours, days, or weeks; Specific time allows you to
     select the date and time.
   • End Time: Enter an offset time or a specific end time to pull the data from. Offset time allows
     you to set time in seconds, minutes, hours, days, or weeks; Specific time allows you to select
     the date and time.
5. Click Run to view the result.
6. Click Save to add the operator to the playbook.
7. Click Cancel to discard the operator form.

Usage Details

LQL Command

filterBaselineTableByTime(baselineTable, "BatchStartTime", "BatchEndTime")

filterBaselineTableByTime(baselineTable, "1521078000000", "1521078300000")

filterBaselineTableByTime(baselineTable, "BatchStartTime-100000", "BatchEndTime")

filterBaselineTableByTime(baselineTable, "BatchStartTime-100000", "BatchEndTime", "lhub_ts")

-- Note: BatchStartTime and BatchEndTime refers to the start/end time of the current "query" (or stream batch if you are running the playbook to compute a stream batch, hence the name). In another simple words, it means the current start and end time of the playbook.