OPTIONS Statement

You can use the training model classification in advanced search queries, correlation, aggregation rules, and Bloks, by adding the following syntax in the query:

OPTIONS useClassifier=<modelName>

The search result displays the following additional columns:

• ll_tax_action: Action performed by the logged-in user.
• ll_tax_event_type: Type of event, such as config activity or standard activity.
• ll_tax_intent: Intention of the action, such as authentication or common use.
• ll_tax_outcome: Outcome of the user's action, such as successful or failed.
• ll_tax_target: The parameter affected by the user's action, such as Application context or Auth policy.

The triplet ll_tax_action, ll_tax_event_type, and ll_tax_intent together indicate the user's action.