scoreManually

[ 1 Example ] [ 2 Operator Usage in Easy Mode ]

Score events manually instead of using a generic scorer. This operator adds an lhub_score column to the input table. The column is a dropdown menu with values 0.0 - 10.0. After assigning scores, you can save them in Rule Set. See Create score rules for instructions.

Rule set is the collection of rules, where each rule (rule) is a mapping of values in the argument to a score.

To view rule sets select Rule Sets in top menu bar in the UI.

LQL Command

scoreManually(inputTable, columns, defaultScore)

Input:
inputTable: The table containing the data to run this operator on.
columns: Comma-separated list of columns to group events by.
defaultScore: Optional default score.

Output
A score table where each score is set only if a score has been assigned manually.

Example

Input
table with f1, f2, f3 columns

LQL command

scoreManually(table, ["f1", "f2"], 5.0)
-- will score table and will set score to 5.0 for each of the rows, when the score is changed in the row, then it will create a rule for f1, f2 =&gt; that score

scoreManually(table, ["f1", "f2"])
-- will score table and will set empty score (null) for each of the rows, when the score is changed in the row, then it will create a rule for f1, f2 =&gt; that score

scoreManually(table, [], 5.0)
-- will score table and will set score to 5.0 for each of the rows, when the score is changed in the row, then it will create a rule for f1, f2, f3 =&gt; that score

-- for each of above examples you can change the scores for each of the rows in the table by clickick lhub_score cell of that row and from drop down menu assign a score.

Operator Usage in Easy Mode

Click + on the parent node.
Enter the Score Manually operator in the search field and select the operator from the Results to open the operator form.
In the Input Table drop-down, enter or select the name of the table containing the data to run this operator on.
In the Columns drop-down, enter or select a list of columns to group events by.
Optional. In the Default Score, enter a value.
Click Run to view the result.
Click Save to add the operator to the playbook.
Click Cancel to discard the operator form.