Run analysis
Evaluates an analysis configured in the event type against the current event and exposes the result to the following conditions.
| Configuration | Content |
|---|---|
| Analysis | analysis existing in the event type |
| Setting: Result | name under which the result becomes available; default: the analysis name |
| Destination | fields that receive each reading (all optional) |
The result becomes available as a temporary variable, with five attributes:
| Attribute | Label in the panel | Content |
|---|---|---|
score | Score | calculated score |
score_cell | Score cell | cell the score came from |
triggered | Triggered | whether the analysis was triggered |
triggered_count | Triggered cell count | how many cells were triggered |
triggered_cells | Triggered cells | names of the triggered cells |
Condition 1: $amount > 0 → Run analysis: bot
Condition 2: %bot.triggered_count >= 2 → Set field: review = "true"
Condition 3: "email_velocity" in %bot.triggered_cells → Add to list: $user_email to @blocked_emails
Beyond those five attributes, each evaluated cell publishes the raw value it measured in the window, under %<result>.cells.<cell>.value. A cell with no trigger delivers its number through this variable, which is equally available to the other cells.
The Destination fields are optional and serve to persist a reading in the event, making it queryable in metrics and monitors. Like every temporary variable, the result itself is not written. When persisting Triggered cells, the names are written to a single text field, separated by commas.
The result name only needs to be provided when the same rule runs the same analysis twice: each run is its own result and needs a distinct name.
This action only reads: it does not feed the analysis’s windows. To feed them, use record analysis.