diff --git a/docs/4-data-queries/index.md b/docs/4-data-queries/index.md index 6bb496241..2bbbf77a1 100644 --- a/docs/4-data-queries/index.md +++ b/docs/4-data-queries/index.md @@ -17,6 +17,11 @@ Query and analyze your security telemetry using LimaCharlie Query Language (LCQL ### Run an LCQL Query +!!! info "Facets and histogram are opt-in" + The search API supports two optional boolean request body fields, `include_facets` and `include_histogram`. Both default to `false`: when they are omitted (or sent as `false`), the response is returned without facet aggregations and without the time-distribution histogram, and the matching response keys come back empty. Send `true` to request either block. + + The web Query Console always opts in, so its facets sidebar and histogram render unchanged. This only affects callers using the REST API, the SDKs, or `lc-cli` directly. + === "REST API" ```bash @@ -33,7 +38,9 @@ Query and analyze your security telemetry using LimaCharlie Query Language (LCQL "query": "event.FILE_PATH ends with .exe", "startTime": "'"$START"'", "endTime": "'"$END"'", - "stream": "event" + "stream": "event", + "include_facets": true, + "include_histogram": true }' ``` diff --git a/docs/8-reference/story-tags.md b/docs/8-reference/story-tags.md index 194f16c16..92901a293 100644 --- a/docs/8-reference/story-tags.md +++ b/docs/8-reference/story-tags.md @@ -40,7 +40,7 @@ Every segment that isn't a fixed keyword has a strict regex: | `TARGET_NAME` | `^[a-z0-9][a-z0-9_.-]{0,127}$` | Same as `STORY_NAME` plus `.` (covers Hive record keys with dots). | | `LABEL_SLUG` | `^[a-z0-9][a-z0-9_-]{0,63}$` | Same as `STORY_NAME`. Rendered with `-` and `_` turned into spaces. | -Tags that violate any gate are **silently dropped** by the assembler — they never produce phantom nodes or edges. This matches the [`lc:asset:*`](asset-tags.md) convention: malformed metadata must never show up in a dashboard. +Tags that violate any gate are **silently dropped** by the assembler — they never produce phantom nodes or edges. This matches the [`lc:asset:*`](../2-sensors-deployment/asset-tags.md) convention: malformed metadata must never show up in a dashboard. ### Canonical type slugs