Run analysis

Evaluates an analysis configured in the event type against the current event and exposes the result to the following conditions.

Configuration Content
Analysis analysis existing in the event type
Setting: Result name under which the result becomes available; default: the analysis name
Destination fields that receive each reading (all optional)

The result becomes available as a temporary variable, with five attributes:

Attribute Label in the panel Content
score Score calculated score
score_cell Score cell cell the score came from
triggered Triggered whether the analysis was triggered
triggered_count Triggered cell count how many cells were triggered
triggered_cells Triggered cells names of the triggered cells
Condition 1:  $amount > 0                          → Run analysis: bot
Condition 2:  %bot.triggered_count >= 2            → Set field: review = "true"
Condition 3:  "email_velocity" in %bot.triggered_cells  → Add to list: $user_email to @blocked_emails

Beyond those five attributes, each evaluated cell publishes the raw value it measured in the window, under %<result>.cells.<cell>.value. A cell with no trigger delivers its number through this variable, which is equally available to the other cells.

The Destination fields are optional and serve to persist a reading in the event, making it queryable in metrics and monitors. Like every temporary variable, the result itself is not written. When persisting Triggered cells, the names are written to a single text field, separated by commas.

An additional target, Version, writes which version of the analysis evaluated the event. Persisting this reading is what makes it possible, later, to separate the events decided by one version from those decided by the next.

The result name only needs to be provided when the same rule runs the same analysis twice: each run is its own result and needs a distinct name.

This action only reads: it does not feed the analysis’s windows. To feed them, use record analysis.