What NovaQL is for
NovaQL describes the conditions that a detection rule looks for in security data. Teams can review what behavior the rule is intended to detect, which events it needs and the alert it should produce.
NQL searches retained event evidence for an analyst question. NovaQL describes detection logic that can evaluate eligible evidence. They serve different purposes even when they refer to similar fields.
Review and approve detection changes
- State the behavior, threat, or coverage gap the logic is intended to detect.
- Confirm the required sources, fields, scope, and freshness expectations.
- Test representative matching and non-matching evidence.
- Review expected noise, missed conditions, priority, ownership, and operational impact.
- Obtain the required review before enabling or changing production behavior.
Use the reference for your deployed version
Supported NovaQL fields, operators, validation tools, and change steps are documented inside authenticated Help. This public guide does not publish syntax that may be unavailable or unsafe for a different customer deployment.