OptionalenabledSets whether the job is scheduled to run. Defaults to true.
OptionaltimingDefines the minimum cadence as a duration string. It may contain components
for days, hours, minutes, and seconds (e.g. 5d, 5d3h, 3d2h5m12s,
12m16s).
Defines the schedule using a Quartz cron expression.
Runs the rule continuously. Detection rules do not accept it: batch rules reject it, and streaming rules run continuously without it.
Defines when a detection rule executes.
A batch rule sets exactly one of
at_least_everyorcron_expression. A streaming rule runs continuously and sets no timing; it accepts onlyenabled, and an omitted schedule means enabled. The server rejects any other combination.enabledis orthogonal to the timing.