Which Unified Data Model (UDM) field search specifies a security action?1 分security_result.actionblockactionmetadata.event_type

The Unified Data Model (UDM) field that specifies a security action is security_result.action. Here's a step-by-step guide on how to use it:

1. Open your search interface in the platform that uses UDM (like Splunk).
2. In the search bar, input security_result.action=<desired_action>. Replace <desired_action> with the specific security action you want to search for. This could be actions like "block", "allow", "alert", etc.
3. Run the search. The results will show events where the specified security action was taken.

Please note that the exact syntax might vary depending on the platform you're using. Always refer to the specific documentation of your platform for the most accurate information.