diff_runs
Compares two detection runs to identify alerts added, removed, or changed, grouped by SID for review.
Instructions
Alerts added, removed and changed between two runs, grouped by SID. Example: diff_runs(run_a="r-0002", run_b="r-0003")
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| run_a | Yes | ||
| run_b | Yes |