scoreManually

Score events manually instead of using a generic scorer. This operator adds an lhub_score column to the input table. The column is a dropdown menu with values 0.0 - 10.0. After assigning scores, you can save them in Rule Set. See Create score rules for instructions.

Rule set is the collection of rules, where each rule (rule) is a mapping of values in the argument to a score.

To view rule sets select Rule Sets in top menu bar in the UI.

scoreManually(inputTable, columns, defaultScore)

Input:
inputTable: The table containing the data to run this operator on.
columns: Comma-separated list of columns to group events by.
defaultScore: Optional default score.

Output
A score table where each score is set only if a score has been assigned manually.

Example

Input
table with f1, f2, f3 columns

scoreManually(table, ["f1", "f2"], 5.0)
-- will score table and will set score to 5.0 for each of the rows, when the score is changed in the row, then it will create a rule for f1, f2 => that score

scoreManually(table, ["f1", "f2"])
-- will score table and will set empty score (null) for each of the rows, when the score is changed in the row, then it will create a rule for f1, f2 => that score

scoreManually(table, [], 5.0)
-- will score table and will set score to 5.0 for each of the rows, when the score is changed in the row, then it will create a rule for f1, f2, f3 => that score

-- for each of above examples you can change the scores for each of the rows in the table by clickick lhub_score cell of that row and from drop down menu assign a score.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter the Score Manually operator in the search field and select the operator from the Results to open the operator form.
3. In the Input Table drop-down, enter or select the name of the table containing the data to run this operator on.
4. In the Columns drop-down, enter or select a list of columns to group events by.
5. Optional. In the Default Score, enter a value.
6. Click Run to view the result.
7. Click Save to add the operator to the playbook.
8. Click Cancel to discard the operator form.