compareDuration property
When compare_duration is set, the GroupResult's "state_change" attribute is updated to indicate whether the finding had its state changed, the finding's state remained unchanged, or if the finding was added during the compare_duration period of time that precedes the read_time.
This is the time between (read_time - compare_duration) and read_time. The
state_change value is derived based on the presence and state of the
finding at the two points in time. Intermediate state changes between the
two times don't affect the result. For example, the results aren't
affected if the finding is made inactive and then active again. Possible
"state_change" values when compare_duration is specified: * "CHANGED":
indicates that the finding was present and matched the given filter at the
start of compare_duration, but changed its state at read_time. *
"UNCHANGED": indicates that the finding was present and matched the given
filter at the start of compare_duration and did not change state at
read_time. * "ADDED": indicates that the finding did not match the given
filter or was not present at the start of compare_duration, but was
present at read_time. * "REMOVED": indicates that the finding was present
and matched the filter at the start of compare_duration, but did not match
the filter at read_time. If compare_duration is not specified, then the
only possible state_change is "UNUSED", which will be the state_change set
for all findings present at read_time. If this field is set then
state_change must be a specified field in group_by.
Implementation
core.String? compareDuration;