get_field_summary
Analyze a field's value distribution, temporal stats, and related fields to accelerate SOC investigations.
Instructions
Get detailed information about a specific field.
This tool provides deep analysis of a single field including value distribution, statistics, temporal information, and related fields that commonly appear together.
Args: field_name: Name of the field to analyze indexes: List of indexes to search (None = all indexes) timeframe: Time range to analyze (e.g., "-7d", "-30d")
Returns: Dictionary containing detailed field information: - field_name: The field name - type: Detected field type - total_unique_values: Count of unique values - top_values: Most common values with counts and percentages - first_seen: Earliest timestamp - last_seen: Latest timestamp - related_fields: Fields that commonly appear with this field - usage_by_sourcetype: Breakdown of usage by sourcetype
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| indexes | No | ||
| timeframe | No | -7d | |
| field_name | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |