From 6519075da3d7031eb2f20df76df6e95204cb0e96 Mon Sep 17 00:00:00 2001 From: "[Steve Brant]" <[steve@limacharlie.com]> Date: Tue, 26 May 2026 11:13:31 -0600 Subject: [PATCH 1/2] docs(search): document include_facets/include_histogram opt-in toggles The search API now accepts include_facets and include_histogram as optional boolean request body fields. Both default to false: callers that omit them receive an empty facets block and no histogram. Note the new defaults in the Query Console docs and update the REST API curl example to show how to opt in. Webapp behavior is unchanged because the console sends explicit true for both. Refs refractionPOINT/replay#442, refractionPOINT/web-app-frontend#3767 Co-Authored-By: Claude Opus 4.7 (1M context) --- docs/4-data-queries/index.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/4-data-queries/index.md b/docs/4-data-queries/index.md index 6bb496241..2bbbf77a1 100644 --- a/docs/4-data-queries/index.md +++ b/docs/4-data-queries/index.md @@ -17,6 +17,11 @@ Query and analyze your security telemetry using LimaCharlie Query Language (LCQL ### Run an LCQL Query +!!! info "Facets and histogram are opt-in" + The search API supports two optional boolean request body fields, `include_facets` and `include_histogram`. Both default to `false`: when they are omitted (or sent as `false`), the response is returned without facet aggregations and without the time-distribution histogram, and the matching response keys come back empty. Send `true` to request either block. + + The web Query Console always opts in, so its facets sidebar and histogram render unchanged. This only affects callers using the REST API, the SDKs, or `lc-cli` directly. + === "REST API" ```bash @@ -33,7 +38,9 @@ Query and analyze your security telemetry using LimaCharlie Query Language (LCQL "query": "event.FILE_PATH ends with .exe", "startTime": "'"$START"'", "endTime": "'"$END"'", - "stream": "event" + "stream": "event", + "include_facets": true, + "include_histogram": true }' ``` From 85b225c5d7736379b90f2d82dac094dbd82da867 Mon Sep 17 00:00:00 2001 From: "[Steve Brant]" <[steve@limacharlie.com]> Date: Tue, 26 May 2026 11:24:18 -0600 Subject: [PATCH 2/2] docs(reference): fix broken asset-tags link in story-tags The link `[lc:asset:*](asset-tags.md)` resolved into 8-reference/ where no asset-tags.md exists; the canonical file lives at docs/2-sensors-deployment/asset-tags.md and is already referenced correctly later in the same page. Use the same relative path. Unblocks the docs link checker on PR #242. Co-Authored-By: Claude Opus 4.7 (1M context) --- docs/8-reference/story-tags.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/8-reference/story-tags.md b/docs/8-reference/story-tags.md index 194f16c16..92901a293 100644 --- a/docs/8-reference/story-tags.md +++ b/docs/8-reference/story-tags.md @@ -40,7 +40,7 @@ Every segment that isn't a fixed keyword has a strict regex: | `TARGET_NAME` | `^[a-z0-9][a-z0-9_.-]{0,127}$` | Same as `STORY_NAME` plus `.` (covers Hive record keys with dots). | | `LABEL_SLUG` | `^[a-z0-9][a-z0-9_-]{0,63}$` | Same as `STORY_NAME`. Rendered with `-` and `_` turned into spaces. | -Tags that violate any gate are **silently dropped** by the assembler — they never produce phantom nodes or edges. This matches the [`lc:asset:*`](asset-tags.md) convention: malformed metadata must never show up in a dashboard. +Tags that violate any gate are **silently dropped** by the assembler — they never produce phantom nodes or edges. This matches the [`lc:asset:*`](../2-sensors-deployment/asset-tags.md) convention: malformed metadata must never show up in a dashboard. ### Canonical type slugs