Stages and Predicates
Stage 1: falco_condition
and
jevt.rawtime eq "0"
stage eq "ResponseComplete"
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
jevt.rawtime | eq |
| field:"jevt.rawtime" kind:eq value:"0" |
stage | in |
| field:"stage" kind:in value:"ResponseComplete" |