malcolm_data_coverage
Assess data coverage by reviewing sensor status, latest timestamps, and dataset distribution. Use before a hunt to know what data is available.
Instructions
Show data freshness, sensor status, and dataset distribution.
Reports:
Which sensors are feeding data and their latest timestamps
How old the most recent data is
Document counts per event.dataset (conn, dns, ssl, alert, etc.)
Index sizes
Call before a hunt to understand what data is available.
Args: time_from: Start time for dataset counts (dateparser format). time_to: End time for dataset counts.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| time_to | No | ||
| time_from | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |