@robinmordasiewicz/f5xc-api-mcp 2.0.10-2601051503 → 2.0.19-2601071557

package/specs/domains/threat_campaign.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "Threat Campaign",
     "description": "F5 Distributed Cloud Threat Campaign API specifications",
-    "version": "2.0.10",
+    "version": "2.0.19",
     "contact": {
       "name": "F5 Distributed Cloud",
       "url": "https://docs.cloud.f5.com"
@@ -12,7 +12,57 @@
       "name": "Proprietary",
       "url": "https://www.f5.com/company/policies/eula"
     },
-    "x-f5xc-cli-domain": "threat_campaign"
+    "x-f5xc-cli-domain": "threat_campaign",
+    "x-f5xc-best-practices": {
+      "common_errors": [
+        {
+          "code": 400,
+          "message": "Invalid request body",
+          "resolution": "Validate JSON structure and required fields before submission",
+          "prevention": "Use schema validation from OpenAPI spec"
+        },
+        {
+          "code": 401,
+          "message": "Authentication failed",
+          "resolution": "Verify API token is valid and not expired",
+          "prevention": "Use environment variables for token management"
+        },
+        {
+          "code": 403,
+          "message": "Permission denied",
+          "resolution": "Check user role and namespace permissions",
+          "prevention": "Verify RBAC policies before operations"
+        },
+        {
+          "code": 404,
+          "message": "Resource not found",
+          "resolution": "Verify resource name and namespace exist",
+          "prevention": "List resources before attempting operations"
+        },
+        {
+          "code": 409,
+          "message": "Resource already exists",
+          "resolution": "Use unique name or delete existing resource",
+          "prevention": "Check existence before creation"
+        },
+        {
+          "code": 429,
+          "message": "Rate limit exceeded",
+          "resolution": "Implement exponential backoff and retry logic",
+          "prevention": "Batch operations and add delays between requests"
+        }
+      ],
+      "security_notes": [
+        "Always use HTTPS for all API communications",
+        "Store API tokens securely, never in source code",
+        "Rotate API tokens regularly following security policies"
+      ],
+      "performance_tips": [
+        "Use pagination for large result sets",
+        "Batch related operations when possible",
+        "Cache read-only responses appropriately"
+      ]
+    }
   },
   "servers": [
     {
@@ -251,6 +301,13 @@
             "latency": "low",
             "resource_usage": "low"
           }
+        },
+        "x-f5xc-discovered-response-time": {
+          "p50_ms": 200,
+          "p95_ms": 800,
+          "p99_ms": 2000,
+          "sample_count": 0,
+          "source": "estimate"
         }
       },
       "x-displayname": "Application Security Monitoring APIs.",
@@ -317,6 +374,8 @@
         "default": "VIOL_NONE",
         "x-displayname": "App Firewall Violation Type.",
         "x-ves-proto-enum": "ves.io.schema.app_firewall.AppFirewallViolationType",
+        "x-f5xc-description-short": "List of all supported Violation Types VIOL_NONE VIOL_FILETYPE VIOL_METHOD VIOL_MANDATORY_HEADER VIOL_HTTP_RESPONSE_STATUS VIOL_REQUEST_MAX_LENGTH...",
+        "x-f5xc-description-medium": "List of all supported Violation Types VIOL_NONE VIOL_FILETYPE VIOL_METHOD VIOL_MANDATORY_HEADER VIOL_HTTP_RESPONSE_STATUS VIOL_REQUEST_MAX_LENGTH VIOL_FILE_UPLOAD VIOL_FILE_UPLOAD_IN_BODY VIOL_XML_MALFORMED VIOL_JSON_MALFORMED VIOL_ASM_COOKIE_MODIFIED VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS...",
         "x-f5xc-minimum-configuration": {
           "description": "Web Application Firewall (WAF) policy for protecting HTTP applications",
           "required_fields": [
@@ -367,6 +426,8 @@
         "default": "ATTACK_TYPE_NONE",
         "x-displayname": "Attack Types.",
         "x-ves-proto-enum": "ves.io.schema.app_firewall.AttackType",
+        "x-f5xc-description-short": "List of all Attack Types ATTACK_TYPE_NONE ATTACK_TYPE_NON_BROWSER_CLIENT ATTACK_TYPE_OTHER_APPLICATION_ATTACKS ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE...",
+        "x-f5xc-description-medium": "List of all Attack Types ATTACK_TYPE_NONE ATTACK_TYPE_NON_BROWSER_CLIENT ATTACK_TYPE_OTHER_APPLICATION_ATTACKS ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE ATTACK_TYPE_DETECTION_EVASION ATTACK_TYPE_VULNERABILITY_SCAN ATTACK_TYPE_ABUSE_OF_FUNCTIONALITY ATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS...",
         "x-f5xc-minimum-configuration": {
           "description": "Web Application Firewall (WAF) policy for protecting HTTP applications",
           "required_fields": [
@@ -402,6 +463,7 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.max_len": "256"
             },
+            "x-f5xc-description-short": "Collapsed URL is the path with identified DYN components.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -426,6 +488,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "API Endpoint indentified by collapsed_url and method.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityApiEndpoint",
           "required_fields": [
@@ -456,6 +519,7 @@
             "x-displayname": "HTTP Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "HTTP load balancer for which this API endpoint protection rule applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -466,7 +530,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908636+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792831+00:00"
           },
           "namespace": {
             "type": "string",
@@ -475,6 +539,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Shared",
             "x-f5xc-example": "shared",
+            "x-f5xc-description-short": "Namespace of the App type for current request.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -485,7 +550,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908642+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792838+00:00"
           },
           "path": {
             "type": "string",
@@ -506,6 +571,7 @@
               "ves.io.schema.rules.string.max_len": "1024",
               "ves.io.schema.rules.string.templated_http_path": "true"
             },
+            "x-f5xc-description-short": "Path to apply the API endpoint protection to Required: YES.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -515,6 +581,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "GET suggested API endpoint protection rule for a given path.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedAPIEndpointProtectionRuleReq",
           "required_fields": [
@@ -544,6 +611,7 @@
             "$ref": "#/components/schemas/common_wafAPIEndpointProtectionRule"
           }
         },
+        "x-f5xc-description-short": "GET suggested API endpoint protection rule for a given path.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedAPIEndpointProtectionRuleRsp",
           "required_fields": [
@@ -605,6 +673,7 @@
               "ves.io.schema.rules.uint32.gte": "0",
               "ves.io.schema.rules.uint32.lte": "401308"
             },
+            "x-f5xc-description-short": "RFC 6793 defined 4-byte AS number Required: YES.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -646,6 +715,7 @@
             "x-displayname": "HTTP Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "HTTP load balancer for which this WAF exclusion will be applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -656,7 +726,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908658+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792853+00:00"
           },
           "namespace": {
             "type": "string",
@@ -665,6 +735,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Shared",
             "x-f5xc-example": "shared",
+            "x-f5xc-description-short": "Namespace of the App type for current request.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -675,7 +746,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908663+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792857+00:00"
           },
           "user_id": {
             "type": "string",
@@ -701,6 +772,7 @@
             "x-field-mutability": "read-only"
           }
         },
+        "x-f5xc-description-short": "GET suggested blocking SimpleClientSrcRule for a given IP/ASN.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedBlockClientRuleReq",
           "required_fields": [
@@ -735,6 +807,7 @@
             "x-displayname": "HTTP Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "HTTP load balancer for which this WAF exclusion will be applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -745,12 +818,13 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908671+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792865+00:00"
           },
           "rule": {
             "$ref": "#/components/schemas/common_wafSimpleClientSrcRule"
           }
         },
+        "x-f5xc-description-short": "GET suggested blocking SimpleClientSrcRule for a given IP/ASN.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedBlockClientRuleRsp",
           "required_fields": [
@@ -792,6 +866,7 @@
               "ves.io.schema.rules.repeated.max_items": "64",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "Sources that are located in one of the countries in the given list.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -812,6 +887,7 @@
             "x-displayname": "Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "Load balancer for which this WAF exclusion will be applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -822,7 +898,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908683+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792876+00:00"
           },
           "namespace": {
             "type": "string",
@@ -831,6 +907,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Shared",
             "x-f5xc-example": "shared",
+            "x-f5xc-description-short": "Namespace of the App type for current request.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -841,12 +918,13 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908687+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792880+00:00"
           },
           "tls_fingerprint_matcher": {
             "$ref": "#/components/schemas/policyTlsFingerprintMatcherType"
           }
         },
+        "x-f5xc-description-short": "GET suggested blocking DDoSMitigtionRule for a given IP/ASN/Country/TLS.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedDDoSMitigtionRuleReq",
           "required_fields": [
@@ -885,6 +963,7 @@
             "x-displayname": "DDoS Mitigation Rule Name.",
             "x-ves-example": "VES-I/O-DDoS-mitigation-rule.",
             "x-f5xc-example": "ves-io-ddos-mitigation-rule",
+            "x-f5xc-description-short": "HTTP load balancer for which this DDoS Mitigation Rule will be applied.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -895,6 +974,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "GET suggested DDoS Mitigtion Rule for a given IP/ASN/Country/TLS.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedDDoSMitigtionRuleRsp",
           "required_fields": [
@@ -925,6 +1005,7 @@
             },
             "x-displayname": "API Groups membership.",
             "x-f5xc-example": "[\"group-1\", \"group-2\"]",
+            "x-f5xc-description-short": "List of API Groups the API Endpoint is a member of.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -942,6 +1023,7 @@
             "x-displayname": "HTTP Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "HTTP load balancer for which this Open API specification validation rule applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -952,7 +1034,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908701+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792892+00:00"
           },
           "namespace": {
             "type": "string",
@@ -961,6 +1043,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Shared",
             "x-f5xc-example": "shared",
+            "x-f5xc-description-short": "Namespace of the App type for current request.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -971,7 +1054,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908705+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792896+00:00"
           },
           "path": {
             "type": "string",
@@ -992,6 +1075,7 @@
               "ves.io.schema.rules.string.max_len": "1024",
               "ves.io.schema.rules.string.templated_http_path": "true"
             },
+            "x-f5xc-description-short": "Path to apply the Open API specification validation to Required: YES.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -1001,6 +1085,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "GET suggested Open API specification validation for a given path.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedOasValidationRuleReq",
           "required_fields": [
@@ -1035,6 +1120,7 @@
             "$ref": "#/components/schemas/schemaEmpty"
           }
         },
+        "x-f5xc-description-short": "GET suggested Open API specification validation for a given path.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedOasValidationRuleRsp",
           "required_fields": [
@@ -1066,6 +1152,7 @@
             "x-displayname": "HTTP Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "HTTP load balancer for which this rate limit rule applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -1076,7 +1163,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908717+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792907+00:00"
           },
           "namespace": {
             "type": "string",
@@ -1085,6 +1172,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Shared",
             "x-f5xc-example": "shared",
+            "x-f5xc-description-short": "Namespace of the App type for current request.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -1095,7 +1183,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908721+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792912+00:00"
           },
           "path": {
             "type": "string",
@@ -1116,6 +1204,7 @@
               "ves.io.schema.rules.string.max_len": "1024",
               "ves.io.schema.rules.string.templated_http_path": "true"
             },
+            "x-f5xc-description-short": "Path to apply the rate limit to Required: YES.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -1125,6 +1214,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "GET suggested rate limit rule for a given path.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedRateLimitRuleReq",
           "required_fields": [
@@ -1154,6 +1244,7 @@
             "$ref": "#/components/schemas/common_wafApiEndpointRule"
           }
         },
+        "x-f5xc-description-short": "GET suggested rate limit rule for a given path.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedRateLimitRuleRsp",
           "required_fields": [
@@ -1184,6 +1275,7 @@
             "x-displayname": "HTTP Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "HTTP load balancer for which this sensitive data rule applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -1194,7 +1286,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908732+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792922+00:00"
           },
           "namespace": {
             "type": "string",
@@ -1203,6 +1295,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Shared",
             "x-f5xc-example": "shared",
+            "x-f5xc-description-short": "Namespace of the App type for current request.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -1213,7 +1306,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908736+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792927+00:00"
           },
           "path": {
             "type": "string",
@@ -1234,6 +1327,7 @@
               "ves.io.schema.rules.string.max_len": "1024",
               "ves.io.schema.rules.string.templated_http_path": "true"
             },
+            "x-f5xc-description-short": "Path to apply the senstive data to Required: YES.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -1243,6 +1337,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "GET suggested sensitive data rule for a given path.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedSensitiveDataRuleReq",
           "required_fields": [
@@ -1272,6 +1367,7 @@
             "$ref": "#/components/schemas/http_loadbalancerSensitiveDataTypes"
           }
         },
+        "x-f5xc-description-short": "GET suggested sensitive data rule for a given path.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedSensitiveDataRuleRsp",
           "required_fields": [
@@ -1333,6 +1429,7 @@
               "ves.io.schema.rules.uint32.gte": "0",
               "ves.io.schema.rules.uint32.lte": "401308"
             },
+            "x-f5xc-description-short": "RFC 6793 defined 4-byte AS number Required: YES.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -1375,6 +1472,7 @@
             "x-displayname": "IP Reputation Security Event.",
             "x-ves-example": "True",
             "x-f5xc-example": "true",
+            "x-f5xc-description-short": "Indicates whether the security event is IP reputation.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -1389,6 +1487,7 @@
             "x-displayname": "HTTP Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "HTTP load balancer for which this client blocking rule will be applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -1399,7 +1498,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908752+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792941+00:00"
           },
           "namespace": {
             "type": "string",
@@ -1408,6 +1507,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Shared",
             "x-f5xc-example": "shared",
+            "x-f5xc-description-short": "Namespace of the App type for current request.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -1418,7 +1518,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908768+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792946+00:00"
           },
           "sec_event_name": {
             "type": "string",
@@ -1455,6 +1555,7 @@
               "ves.io.schema.rules.repeated.max_items": "4",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of Security Event types that should stop being generated for this client.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -1470,6 +1571,7 @@
             "x-displayname": "Threat Mesh Security Event.",
             "x-ves-example": "True",
             "x-f5xc-example": "true",
+            "x-f5xc-description-short": "Indicates whether the security event is threat mesh.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -1501,6 +1603,7 @@
             "x-field-mutability": "read-only"
           }
         },
+        "x-f5xc-description-short": "GET suggested blocking SimpleClientSrcRule for a given IP/ASN.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedTrustClientRuleReq",
           "required_fields": [
@@ -1539,6 +1642,7 @@
             "x-displayname": "HTTP Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "HTTP load balancer for which this client rule will be applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -1549,12 +1653,13 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908781+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792957+00:00"
           },
           "rule": {
             "$ref": "#/components/schemas/common_wafSimpleClientSrcRule"
           }
         },
+        "x-f5xc-description-short": "GET suggested SimpleClientSrcRule to trust a given IP/ASN.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedTrustClientRuleRsp",
           "required_fields": [
@@ -1605,7 +1710,7 @@
             "x-original-maxLength": 256,
             "format": "hostname",
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908791+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792967+00:00"
           },
           "exclude_bot_names": {
             "type": "array",
@@ -1626,6 +1731,7 @@
               "ves.io.schema.rules.repeated.max_items": "64",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "Bot name contexts to be excluded for this request.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -1652,6 +1758,7 @@
               "ves.io.schema.rules.repeated.max_items": "1024",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "App Firewall signature contexts to be excluded for this request.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -1678,6 +1785,7 @@
               "ves.io.schema.rules.repeated.max_items": "64",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "App Firewall violation contexts to be excluded for this request.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -1692,6 +1800,7 @@
             "x-displayname": "HTTP Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "HTTP load balancer for which this WAF exclusion will be applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -1702,7 +1811,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908801+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792976+00:00"
           },
           "namespace": {
             "type": "string",
@@ -1711,6 +1820,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Shared",
             "x-f5xc-example": "shared",
+            "x-f5xc-description-short": "Namespace of the App type for current request.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -1721,7 +1831,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908805+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792981+00:00"
           },
           "req_path": {
             "type": "string",
@@ -1758,6 +1868,7 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.pattern": "^$|^[a-fA-F0-9]{8}-([a-fA-F0-9]{4}-){3}[a-fA-F0-9]{12}$"
             },
+            "x-f5xc-description-short": "Unique identifier for the request route.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -1768,6 +1879,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "GET suggested service policy rule to set up WAF rule exclusion for a given WAF security event.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedWAFExclusionRuleReq",
           "required_fields": [
@@ -1805,6 +1917,7 @@
             "x-displayname": "HTTP Load Balancer Name.",
             "x-ves-example": "VES-I/O-frontend.",
             "x-f5xc-example": "ves-io-frontend",
+            "x-f5xc-description-short": "HTTP load balancer for which this WAF exclusion will be applied.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -1815,7 +1928,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908815+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792990+00:00"
           },
           "waf_exclusion_policy": {
             "$ref": "#/components/schemas/schemaviewsObjectRefType"
@@ -1824,6 +1937,7 @@
             "$ref": "#/components/schemas/policySimpleWafExclusionRule"
           }
         },
+        "x-f5xc-description-short": "GET suggested service policy rule to set up WAF rule exclusion for a given WAF security event.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityGetSuggestedWAFExclusionRuleRsp",
           "required_fields": [
@@ -1863,7 +1977,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908822+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.792998+00:00"
           },
           "namespace": {
             "type": "string",
@@ -1882,7 +1996,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908826+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793002+00:00"
           },
           "request_data": {
             "$ref": "#/components/schemas/app_securityRequestData"
@@ -1891,6 +2005,7 @@
             "$ref": "#/components/schemas/app_securitySecurityEventsData"
           }
         },
+        "x-f5xc-description-short": "List of virtual hosts in all the namespaces matching filter provided in the request.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityLoadbalancerData",
           "required_fields": [
@@ -1919,6 +2034,7 @@
             "format": "uint64",
             "x-displayname": "Count",
             "x-f5xc-example": "15",
+            "x-f5xc-description-short": "The number of requests matching the filter for virtual host in the given namespace.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -1936,6 +2052,7 @@
             "x-displayname": "Maximum time.",
             "x-ves-example": "01-01-1970T00:00:00Z.",
             "x-f5xc-example": "01-01-1970T00:00:00Z",
+            "x-f5xc-description-short": "Maximum time at which request ID was found.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -1953,6 +2070,7 @@
             "x-displayname": "Minimum time.",
             "x-ves-example": "01-01-1970T00:00:00Z.",
             "x-f5xc-example": "01-01-1970T00:00:00Z",
+            "x-f5xc-description-short": "Minimum time at which the request ID was found.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2016,9 +2134,10 @@
             "maxLength": 15,
             "minLength": 3,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908843+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793018+00:00"
           }
         },
+        "x-f5xc-description-short": "Metric label filter can be specified to query specific metrics based on label match.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySearchFilter",
           "required_fields": [
@@ -2044,6 +2163,7 @@
         "default": "REQUEST_ID",
         "x-displayname": "Search Label for VH List API.",
         "x-ves-proto-enum": "ves.io.schema.app_security.SearchLabel",
+        "x-f5xc-description-short": "List of Virtual Hosts will be returned matching the following labels.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySearchLabel",
           "required_fields": [],
@@ -2098,6 +2218,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.repeated.max_items": "5"
             },
+            "x-f5xc-description-short": "List of label filter expressions of the form \"label\" \"value\". Response will only contain data that matches all the conditions specified in the .",
+            "x-f5xc-description-medium": "List of label filter expressions of the form \"label\" \"value\". Response will only contain data that matches all the conditions specified in the . One or more of the following labels can be specified in the label_filter. , `.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2112,6 +2234,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Shared",
             "x-f5xc-example": "shared",
+            "x-f5xc-description-short": "Namespace of the App type for current request.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -2122,9 +2245,11 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908850+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793025+00:00"
           }
         },
+        "x-f5xc-description-short": "GET a list of virtual hosts in all the namespaces matching filter provided in the request.",
+        "x-f5xc-description-medium": "GET a list of virtual hosts in all the namespaces matching filter provided in the request. The filter can be a) Request ID b) Source IP.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySearchLoadBalancersRequest",
           "required_fields": [
@@ -2155,6 +2280,7 @@
             "x-displayname": "HTTP Load Balancer List.",
             "x-ves-example": "[VES-I/O-frontend\", \"ns1\" , \"1\", \"0\"]",
             "x-f5xc-example": "\"[ves-io-frontend\", \"ns1\" , \"1\", \"0\"]\"",
+            "x-f5xc-description-short": "HTTP load balancer list for which the SearchFilter is applied.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2163,6 +2289,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "List of virtual hosts in all the namespaces matching filter provided in the request.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySearchLoadBalancersResponse",
           "required_fields": [
@@ -2194,6 +2321,7 @@
         "default": "WAF_SEC_EVENT",
         "x-displayname": "Security Event Type.",
         "x-ves-proto-enum": "ves.io.schema.app_security.SecEventType",
+        "x-f5xc-description-short": "Security event can be one of the following types.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecEventType",
           "required_fields": [],
@@ -2216,6 +2344,8 @@
             "description": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregations are key'ed by user-defined aggregation name. The response will be key'ed with the same name.\nOptional.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security events response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2236,6 +2366,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch security events whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated...",
+            "x-f5xc-description-medium": "Fetch security events whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to <current time>.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2252,6 +2384,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Bloggin-app-namespace-1.",
             "x-f5xc-example": "bloggin-app-namespace-1",
+            "x-f5xc-description-short": "Fetch security events for a given namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -2262,7 +2395,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908861+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793036+00:00"
           },
           "query": {
             "type": "string",
@@ -2271,6 +2404,8 @@
             "x-displayname": "Query",
             "x-ves-example": "Query={app_type=\"blogging_app\"}",
             "x-f5xc-example": "\"query={app_type=\"blogging_app\"}\"",
+            "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> :=...",
+            "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> := string One or more of these fields in the security event may be specified in the query. Vh_name - name of the virtual host src_site - source site city ...",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2293,6 +2428,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch security events whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...",
+            "x-f5xc-description-medium": "Fetch security events whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to <current time>-10m.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2303,6 +2440,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Request to GET only aggregation data for security events.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecurityEventsAggregationRequest",
           "required_fields": [
@@ -2331,6 +2469,8 @@
             "description": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregation data is key'ed with the aggregation name specified in the request.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security events response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregation data is key'ed with the...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2346,6 +2486,7 @@
             "x-displayname": "Total Hits.",
             "x-ves-example": "0",
             "x-f5xc-example": "0",
+            "x-f5xc-description-short": "Total number of security events that matched the query.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2356,6 +2497,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Response message for SecurityEventsAggregationRequest.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecurityEventsAggregationResponse",
           "required_fields": [
@@ -2389,6 +2531,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "End time of metric collection from which data will be considered.",
+            "x-f5xc-description-medium": "End time of metric collection from which data will be considered. Format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to <current time>.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2406,6 +2550,8 @@
               "$ref": "#/components/schemas/metricsSecurityMetricLabel"
             },
             "x-displayname": "Group By",
+            "x-f5xc-description-short": "Aggregate data by one or more labels listed here. , , , , . Optional: If not specified, then the security events are aggregated/grouped by , .",
+            "x-f5xc-description-medium": "Aggregate data by one or more labels listed here. , , , , . Optional: If not specified, then the security events are aggregated/grouped by , .",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2421,6 +2567,8 @@
               "$ref": "#/components/schemas/metricsSecurityMetricLabelFilter"
             },
             "x-displayname": "Label Filter.",
+            "x-f5xc-description-short": "List of label filter expressions of the form \"label\" \"value\". Response will only contain data that matches all the conditions specified in the .",
+            "x-f5xc-description-medium": "List of label filter expressions of the form \"label\" \"value\". Response will only contain data that matches all the conditions specified in the . One or more of the following labels can be specified in the label_filter. , , , .",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2435,6 +2583,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Bloggin-app-namespace-1.",
             "x-f5xc-example": "bloggin-app-namespace-1",
+            "x-f5xc-description-short": "Namespace is used to scope the security events for the given namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -2445,7 +2594,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908878+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793052+00:00"
           },
           "start_time": {
             "type": "string",
@@ -2460,6 +2609,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Start time of metric collection from which data will be considered.",
+            "x-f5xc-description-medium": "Start time of metric collection from which data will be considered. Format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to <current time>-10m.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2482,6 +2633,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_step": "true"
             },
+            "x-f5xc-description-short": "Step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response.",
+            "x-f5xc-description-medium": "Step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response. The timestamps in the response will be t1=start_time, t2=t1+step, ... Tn=tn-1+step, where tn <= end_time.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2492,6 +2645,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Request to GET number of security events for a given namespace.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecurityEventsCountRequest",
           "required_fields": [
@@ -2524,6 +2678,7 @@
               "$ref": "#/components/schemas/metricsSecurityEventsCounter"
             },
             "x-displayname": "Security events counter data.",
+            "x-f5xc-example": "{\"key\": \"value\"}",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2544,6 +2699,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.time_interval": "true"
             },
+            "x-f5xc-description-short": "Actual step size used in the response. It could be higher than the requested step due to metric rollups and the query duration.",
+            "x-f5xc-description-medium": "Actual step size used in the response. It could be higher than the requested step due to metric rollups and the query duration. Format: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2554,6 +2711,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "Number of security events for each unique combination of group_by labels in the SecurityEventsCountRequest.",
+        "x-f5xc-description-medium": "Number of security events for each unique combination of group_by labels in the SecurityEventsCountRequest.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecurityEventsCountResponse",
           "required_fields": [
@@ -2580,6 +2739,7 @@
             "format": "uint64",
             "x-displayname": "Count",
             "x-f5xc-example": "15",
+            "x-f5xc-description-short": "The number of security events for virtual host in the given namespace.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2597,6 +2757,7 @@
             "x-displayname": "Maximum time.",
             "x-ves-example": "01-01-1970T00:00:00Z.",
             "x-f5xc-example": "01-01-1970T00:00:00Z",
+            "x-f5xc-description-short": "Maximum start time at which security event was found.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2614,6 +2775,7 @@
             "x-displayname": "Minimum time.",
             "x-ves-example": "01-01-1970T00:00:00Z.",
             "x-f5xc-example": "01-01-1970T00:00:00Z",
+            "x-f5xc-description-short": "Minimum time at which the secuirty event was found.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2650,6 +2812,8 @@
             "description": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregations are key'ed by user-defined aggregation name. The response will be key'ed with the same name.\nOptional.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security events response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2670,6 +2834,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch security events whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated...",
+            "x-f5xc-description-medium": "Fetch security events whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to <current time>.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2687,6 +2853,8 @@
             "x-displayname": "Limit",
             "x-ves-example": "100",
             "x-f5xc-example": "100",
+            "x-f5xc-description-short": "Limits the number of security events returned in the response Optional: If not specified, first or last 500 security events that matches the query...",
+            "x-f5xc-description-medium": "Limits the number of security events returned in the response Optional: If not specified, first or last 500 security events that matches the query (depending on the sort order) will be returned in the response. The maximum value for limit is 500.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -2703,6 +2871,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Bloggin-app-namespace-1.",
             "x-f5xc-example": "bloggin-app-namespace-1",
+            "x-f5xc-description-short": "Fetch security events for a given namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -2713,7 +2882,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908899+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793072+00:00"
           },
           "query": {
             "type": "string",
@@ -2722,6 +2891,8 @@
             "x-displayname": "Query",
             "x-ves-example": "Query={app_type=\"blogging_app\"}",
             "x-f5xc-example": "\"query={app_type=\"blogging_app\"}\"",
+            "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> :=...",
+            "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> := string One or more of these fields in the security event may be specified in the query. Vh_name - name of the virtual host src_site - source site city ...",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2739,6 +2910,8 @@
             "x-displayname": "Scroll",
             "x-ves-example": "True",
             "x-f5xc-example": "true",
+            "x-f5xc-description-short": "Scroll is used to retrieve large number of security events (or all security events) that matches the query.",
+            "x-f5xc-description-medium": "Scroll is used to retrieve large number of security events (or all security events) that matches the query. If scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next batch of security events until there are no more security events left to return. The...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2754,6 +2927,8 @@
             "description": "Optional: default is sort by last_event_time.",
             "title": "Sort by",
             "x-displayname": "Sort By",
+            "x-f5xc-example": "{\"key\": \"value\"}",
+            "x-f5xc-description-short": "Optional: default is sort by last_event_time.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2776,6 +2951,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch security events whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...",
+            "x-f5xc-description-medium": "Fetch security events whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to <current time>-10m.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2818,6 +2995,8 @@
             "description": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security events response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2835,6 +3014,7 @@
             "x-displayname": "Events",
             "x-ves-example": "Value",
             "x-f5xc-example": "value",
+            "x-f5xc-description-short": "List of security events that matched the query. Contains no more than 500 messages.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2849,6 +3029,8 @@
             "x-displayname": "Scroll ID",
             "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.",
             "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==",
+            "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve the next batch of security events using the scroll request.",
+            "x-f5xc-description-medium": "Long Base-64 encoded string which can be used to retrieve the next batch of security events using the scroll request. Empty scroll_id indicates no more messages to scroll (EOF).",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2867,6 +3049,7 @@
             "x-displayname": "Total Hits.",
             "x-ves-example": "0",
             "x-f5xc-example": "0",
+            "x-f5xc-description-short": "Total number of security events that matched the query.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2877,6 +3060,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Response message for SecurityEventsRequest/SecurityEventsScrollRequest.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecurityEventsResponse",
           "required_fields": [
@@ -2906,6 +3090,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Bloggin-app-namespace-1.",
             "x-f5xc-example": "bloggin-app-namespace-1",
+            "x-f5xc-description-short": "Fetch the WAF security events scoped by namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -2916,7 +3101,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908918+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793090+00:00"
           },
           "scroll_id": {
             "type": "string",
@@ -2925,6 +3110,7 @@
             "x-displayname": "Scroll ID",
             "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.",
             "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==",
+            "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve next batch of security events.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2936,6 +3122,8 @@
             "x-field-mutability": "read-only"
           }
         },
+        "x-f5xc-description-short": "Scroll request is used to fetch large number of security events in multiple batches with each SecurityEventsResponse containing no more than 500...",
+        "x-f5xc-description-medium": "Scroll request is used to fetch large number of security events in multiple batches with each SecurityEventsResponse containing no more than 500 messages. To scroll through more than 500 or all WAF security events, one can use the SecurityEventScrollRequest. Use the scroll_id returned in the...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecurityEventsScrollRequest",
           "required_fields": [
@@ -2961,6 +3149,8 @@
             "description": "Aggregations provide summary/analytics data over security incidents response. If the number of security incidents\nthat matched the query is large and cannot be returned in a single response message, user can GET helpful\ninsights/summary using aggregations. The aggregations are key'ed by user-defined aggregation name.\nThe response will be key'ed with the same name.\nOptional.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over security incidents response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over security incidents response. If the number of security incidents that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -2981,6 +3171,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch security incidents whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be...",
+            "x-f5xc-description-medium": "Fetch security incidents whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to <current time>.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -2997,6 +3189,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Bloggin-app-namespace-1.",
             "x-f5xc-example": "bloggin-app-namespace-1",
+            "x-f5xc-description-short": "Fetch security incidents for a given namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -3007,7 +3200,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908928+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793099+00:00"
           },
           "query": {
             "type": "string",
@@ -3016,6 +3209,8 @@
             "x-displayname": "Query",
             "x-ves-example": "Query={app_type=\"blogging_app\"}",
             "x-f5xc-example": "\"query={app_type=\"blogging_app\"}\"",
+            "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> :=...",
+            "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> := string One or more of these fields in the security event may be specified in the query. Vh_name - name of the virtual host src_site - source site city ...",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3038,6 +3233,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch security incidents whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...",
+            "x-f5xc-description-medium": "Fetch security incidents whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to <current time>-10m.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3048,6 +3245,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Request to GET only aggregation data for security incidents.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecurityIncidentsAggregationRequest",
           "required_fields": [
@@ -3076,6 +3274,8 @@
             "description": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents\nthat matched the query is large and cannot be returned in a single response message, user can GET helpful\ninsights/summary using aggregations. The aggregation data is key'ed with the aggregation name specified in the request.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security incidents response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregation data is key'ed with...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3091,6 +3291,7 @@
             "x-displayname": "Total Hits.",
             "x-ves-example": "0",
             "x-f5xc-example": "0",
+            "x-f5xc-description-short": "Total number of security incidents that matched the query.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3101,6 +3302,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Response message for SecurityIncidentsAggregationRequest.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecurityIncidentsAggregationResponse",
           "required_fields": [
@@ -3126,6 +3328,8 @@
             "description": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents\nthat matched the query is large and cannot be returned in a single response message, user can GET helpful\ninsights/summary using aggregations. The aggregations are key'ed by user-defined aggregation name. The response\nwill be key'ed with the same name.\nOptional.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security incidents response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3146,6 +3350,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch security incidents whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be...",
+            "x-f5xc-description-medium": "Fetch security incidents whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to <current time>.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3163,6 +3369,8 @@
             "x-displayname": "Limit",
             "x-ves-example": "100",
             "x-f5xc-example": "100",
+            "x-f5xc-description-short": "Limits the number of security incidents returned in the response Optional: If not specified, first or last 500 security events that matches the...",
+            "x-f5xc-description-medium": "Limits the number of security incidents returned in the response Optional: If not specified, first or last 500 security events that matches the query (depending on the sort order) will be returned in the response. The maximum value for limit is 500.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -3179,6 +3387,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Bloggin-app-namespace-1.",
             "x-f5xc-example": "bloggin-app-namespace-1",
+            "x-f5xc-description-short": "Fetch security incidents for a given namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -3189,7 +3398,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908944+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793114+00:00"
           },
           "query": {
             "type": "string",
@@ -3198,6 +3407,8 @@
             "x-displayname": "Query",
             "x-ves-example": "Query={app_type=\"blogging_app\"}",
             "x-f5xc-example": "\"query={app_type=\"blogging_app\"}\"",
+            "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> :=...",
+            "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> := string One or more of these fields in the security incident may be specified in the query. Vh_name - name of the virtual host src_site - source site city ...",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3215,6 +3426,8 @@
             "x-displayname": "Scroll",
             "x-ves-example": "True",
             "x-f5xc-example": "true",
+            "x-f5xc-description-short": "Scroll is used to retrieve large number of security incidents (or all security incidents) that matches the query.",
+            "x-f5xc-description-medium": "Scroll is used to retrieve large number of security incidents (or all security incidents) that matches the query. If scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next batch of security events until there are no more security events left to...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3230,6 +3443,8 @@
             "description": "Optional: default is sort by last_event_time.",
             "title": "Sort by",
             "x-displayname": "Sort By",
+            "x-f5xc-example": "{\"key\": \"value\"}",
+            "x-f5xc-description-short": "Optional: default is sort by last_event_time.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3252,6 +3467,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch security incidents whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...",
+            "x-f5xc-description-medium": "Fetch security incidents whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to <current time>-10m.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3294,6 +3511,8 @@
             "description": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents\nthat matched the query is large and cannot be returned in a single response message, user can GET helpful\ninsights/summary using aggregations.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security incidents response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3311,6 +3530,7 @@
             "x-displayname": "Incidents",
             "x-ves-example": "Value",
             "x-f5xc-example": "value",
+            "x-f5xc-description-short": "List of security incidents that matched the query. Contains no more than 500 messages.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3325,6 +3545,8 @@
             "x-displayname": "Scroll ID",
             "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.",
             "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==",
+            "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve the next batch of security incidents using the scroll request.",
+            "x-f5xc-description-medium": "Long Base-64 encoded string which can be used to retrieve the next batch of security incidents using the scroll request. Empty scroll_id indicates no more messages to scroll (EOF).",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3343,6 +3565,7 @@
             "x-displayname": "Total Hits.",
             "x-ves-example": "0",
             "x-f5xc-example": "0",
+            "x-f5xc-description-short": "Total number of security events that matched the query.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3353,6 +3576,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Response message for SecurityIncidentsRequest/SecurityIncidentsScrollRequest.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecurityIncidentsResponse",
           "required_fields": [
@@ -3382,6 +3606,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Bloggin-app-namespace-1.",
             "x-f5xc-example": "bloggin-app-namespace-1",
+            "x-f5xc-description-short": "Fetch security incidents for a given namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -3392,7 +3617,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908962+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793132+00:00"
           },
           "scroll_id": {
             "type": "string",
@@ -3401,6 +3626,7 @@
             "x-displayname": "Scroll ID",
             "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.",
             "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==",
+            "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve next batch of security events.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3412,6 +3638,8 @@
             "x-field-mutability": "read-only"
           }
         },
+        "x-f5xc-description-short": "Scroll request is used to fetch large number of security incidents in multiple batches with each SecurityIncidentsResponse containing no more than...",
+        "x-f5xc-description-medium": "Scroll request is used to fetch large number of security incidents in multiple batches with each SecurityIncidentsResponse containing no more than 500 messages. To scroll through more than 500 or all security incidents, one can use the SecurityIncidentsScrollRequest. Use the scroll_id returned...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySecurityIncidentsScrollRequest",
           "required_fields": [
@@ -3437,6 +3665,8 @@
             "description": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregations are key'ed by user-defined aggregation name. The response will be key'ed with the same name.\nOptional.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the suspicious user logs response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by user-defined...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3457,6 +3687,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch suspicious user logs whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be...",
+            "x-f5xc-description-medium": "Fetch suspicious user logs whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to <current time>.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3473,6 +3705,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Bloggin-app-namespace-1.",
             "x-f5xc-example": "bloggin-app-namespace-1",
+            "x-f5xc-description-short": "Fetch suspicious user logs for a given namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -3483,7 +3716,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908972+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793140+00:00"
           },
           "query": {
             "type": "string",
@@ -3492,6 +3725,8 @@
             "x-displayname": "Query",
             "x-ves-example": "Query={vh_name=\"vh-1\", site=\"CE-01\"}",
             "x-f5xc-example": "\"query={vh_name=\"vh-1\", site=\"ce-01\"}\"",
+            "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> :=...",
+            "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> := string One or more of these fields in the suspicious user logs may be specified in the query. Vh_name - name of the virtual host user - user ID site ...",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3514,6 +3749,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch suspicious user logs whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...",
+            "x-f5xc-description-medium": "Fetch suspicious user logs whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to <current time>-10m.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3524,6 +3761,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Request to GET only aggregation data for suspicious user logs.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySuspiciousUserLogsAggregationRequest",
           "required_fields": [
@@ -3552,6 +3790,8 @@
             "description": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregation data is key'ed with the aggregation name specified in the request.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the suspicious user logs response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregation data is key'ed with the...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3567,6 +3807,7 @@
             "x-displayname": "Total Hits.",
             "x-ves-example": "1400",
             "x-f5xc-example": "1400",
+            "x-f5xc-description-short": "Total number of suspicious user logs that matched the query.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3577,6 +3818,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Response message for SuspiciousUserLogsAggregationRequest.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySuspiciousUserLogsAggregationResponse",
           "required_fields": [
@@ -3602,6 +3844,8 @@
             "description": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregations are key'ed by user-defined aggregation name. The response will be key'ed with the same name.\nOptional.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the suspicious user logs response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by user-defined...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3622,6 +3866,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch suspicious user logs whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be...",
+            "x-f5xc-description-medium": "Fetch suspicious user logs whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to <current time>.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3639,6 +3885,8 @@
             "x-displayname": "Limit",
             "x-ves-example": "100",
             "x-f5xc-example": "100",
+            "x-f5xc-description-short": "Limits the number of logs returned in the response Optional: If not specified, first or last 500 logs that matches the query (depending on the...",
+            "x-f5xc-description-medium": "Limits the number of logs returned in the response Optional: If not specified, first or last 500 logs that matches the query (depending on the sort order) will be returned in the response. The maximum value for limit is 500.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -3655,6 +3903,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Bloggin-app-namespace-1.",
             "x-f5xc-example": "bloggin-app-namespace-1",
+            "x-f5xc-description-short": "Fetch suspicious user logs for a given namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -3665,7 +3914,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.908988+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793156+00:00"
           },
           "query": {
             "type": "string",
@@ -3674,6 +3923,8 @@
             "x-displayname": "Query",
             "x-ves-example": "Query={vh_name=\"vh-1\", site=\"CE-01\"}",
             "x-f5xc-example": "\"query={vh_name=\"vh-1\", site=\"ce-01\"}\"",
+            "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> :=...",
+            "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[<matcher>]} <matcher> := <field_name><operator>\"<value>\" <field_name> := string One or more of these fields in the suspicious user logs may be specified in the query. Vh_name - name of the virtual host user - user ID site ...",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3691,6 +3942,8 @@
             "x-displayname": "Scroll",
             "x-ves-example": "True",
             "x-f5xc-example": "true",
+            "x-f5xc-description-short": "Scroll is used to retrieve large number of logs (or all logs) that matches the query.",
+            "x-f5xc-description-medium": "Scroll is used to retrieve large number of logs (or all logs) that matches the query. If scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next batch of logs until there are no logs left to return. The number of logs in each batch is determined by...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3706,6 +3959,8 @@
             "description": "Optional: default is sort by last_event_time.",
             "title": "Sort by",
             "x-displayname": "Sort By",
+            "x-f5xc-example": "{\"key\": \"value\"}",
+            "x-f5xc-description-short": "Optional: default is sort by last_event_time.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3728,6 +3983,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.query_time": "true"
             },
+            "x-f5xc-description-short": "Fetch suspicious user logs whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...",
+            "x-f5xc-description-medium": "Fetch suspicious user logs whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to <current time>-10m.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3770,6 +4027,8 @@
             "description": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.",
             "title": "Aggregations.",
             "x-displayname": "Aggregations.",
+            "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security events response.",
+            "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3787,6 +4046,7 @@
             "x-displayname": "Events",
             "x-ves-example": "Value",
             "x-f5xc-example": "value",
+            "x-f5xc-description-short": "List of log messages that matched the query. Contains no more than 500 messages.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -3801,6 +4061,8 @@
             "x-displayname": "Scroll ID",
             "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.",
             "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==",
+            "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve the next batch of suspicous user logs using the scroll request.",
+            "x-f5xc-description-medium": "Long Base-64 encoded string which can be used to retrieve the next batch of suspicous user logs using the scroll request. Empty scroll_id indicates no more messages to scroll (EOF).",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3819,6 +4081,7 @@
             "x-displayname": "Total Hits.",
             "x-ves-example": "100",
             "x-f5xc-example": "100",
+            "x-f5xc-description-short": "Total number of logs that matched the query.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3829,6 +4092,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Response message for Suspicious User Logs Request.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySuspiciousUserLogsResponse",
           "required_fields": [
@@ -3858,6 +4122,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Bloggin-app-namespace-1.",
             "x-f5xc-example": "bloggin-app-namespace-1",
+            "x-f5xc-description-short": "Fetch the next batch of suspicious user logs scoped by namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -3868,7 +4133,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909009+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793173+00:00"
           },
           "scroll_id": {
             "type": "string",
@@ -3877,6 +4142,7 @@
             "x-displayname": "Scroll ID",
             "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.",
             "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==",
+            "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve next batch of security events.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -3888,6 +4154,8 @@
             "x-field-mutability": "read-only"
           }
         },
+        "x-f5xc-description-short": "Scroll request is used to fetch large number of suspicious user logs in multiple batches with each SuspiciousUserLogsResponse containing no more...",
+        "x-f5xc-description-medium": "Scroll request is used to fetch large number of suspicious user logs in multiple batches with each SuspiciousUserLogsResponse containing no more than 500 messages. To scroll through more than 500 or all messages, one can use the SuspiciousUserLogsScrollRequest. Use the scroll_id returned in the...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitySuspiciousUserLogsScrollRequest",
           "required_fields": [
@@ -3941,7 +4209,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909018+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793181+00:00"
           },
           "id": {
             "type": "string",
@@ -3998,6 +4266,7 @@
             "x-validation-rules": {
               "ves.io.schema.rules.message.required": "true"
             },
+            "x-f5xc-description-short": "The Threat Campaign last update time Required: YES.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -4024,6 +4293,7 @@
             "x-validation-rules": {
               "ves.io.schema.rules.message.required": "true"
             },
+            "x-f5xc-description-short": "The Threat Campaign Malwares Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -4055,7 +4325,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909030+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793192+00:00"
           },
           "references": {
             "type": "array",
@@ -4114,6 +4384,7 @@
             "x-validation-rules": {
               "ves.io.schema.rules.message.required": "true"
             },
+            "x-f5xc-description-short": "The Threat Campaign Systems Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -4122,6 +4393,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Threat Campaign object representing the created threat campaign.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityThreatCampaign",
           "required_fields": [
@@ -4164,6 +4436,8 @@
             "$ref": "#/components/schemas/app_securityincidentsMultiFieldAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Aggregation Request\" Aggregation request to provide analytics data over the log response.",
+        "x-f5xc-description-medium": "X-displayName: \"Aggregation Request\" Aggregation request to provide analytics data over the log response.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsAggregationRequest",
           "required_fields": [
@@ -4189,6 +4463,8 @@
             "$ref": "#/components/schemas/app_securityincidentsKeyField"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Cardinality Aggregation\" GET approximate count of distinct values for the field in the incident.",
+        "x-f5xc-description-medium": "X-displayName: \"Cardinality Aggregation\" GET approximate count of distinct values for the field in the incident.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsCardinalityAggregation",
           "required_fields": [
@@ -4211,6 +4487,8 @@
             "description": "X-displayName: \"Step\"\nx-required\nstep is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response.\nThe timestamps in the response will be t1=start_time, t2=t1+step, ... Tn=tn-1+step, where tn <= end_time.\nFormat: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days.",
             "title": "Step",
             "x-f5xc-example": "5m",
+            "x-f5xc-description-short": "X-displayName: \"Step\" x-required step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in...",
+            "x-f5xc-description-medium": "X-displayName: \"Step\" x-required step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response. The timestamps in the response will be t1=start_time, t2=t1+step, ... Tn=tn-1+step, where tn <= end_time.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -4224,6 +4502,7 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nThis option provides sub-aggregation for each date bucket.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each date bucket.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -4232,6 +4511,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Date Aggregation\" Aggregate incidents based on timestamp in the log.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsDateAggregation",
           "required_fields": [
@@ -4257,6 +4537,8 @@
             "$ref": "#/components/schemas/app_securityincidentsMultiFieldAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Date SubAggregation\" Aggregate security events based on one of the sub aggregation types.",
+        "x-f5xc-description-medium": "X-displayName: \"Date SubAggregation\" Aggregate security events based on one of the sub aggregation types.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsDateSubAggregation",
           "required_fields": [
@@ -4285,6 +4567,8 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nThis option provides sub-aggregation for each field aggregation bucket.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each field aggregation bucket.",
+            "x-f5xc-description-medium": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each field aggregation bucket.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -4298,6 +4582,7 @@
             "title": "Topk",
             "format": "int64",
             "x-f5xc-example": "10",
+            "x-f5xc-description-short": "X-displayName: \"TopK\" Number of top field values to be returned in the response.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -4308,6 +4593,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field Aggregation\" Aggregate incidents based on the key fields in the security event.",
+        "x-f5xc-description-medium": "X-displayName: \"Field Aggregation\" Aggregate incidents based on the key fields in the security event.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsFieldAggregation",
           "required_fields": [
@@ -4332,6 +4619,8 @@
             "$ref": "#/components/schemas/app_securityincidentsCardinalityAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field SubAggregation\" Aggregate security events in each field bucket based on one of the sub aggregation types.",
+        "x-f5xc-description-medium": "X-displayName: \"Field SubAggregation\" Aggregate security events in each field bucket based on one of the sub aggregation types.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsFieldSubAggregation",
           "required_fields": [
@@ -4362,6 +4651,8 @@
           "INCIDENT_ID"
         ],
         "default": "CITY",
+        "x-f5xc-description-short": "X-displayName: \"Key Field\" Security events can be aggregated based on these fields. - CITY: x-displayName: \"City\" - COUNTRY: x-displayName...",
+        "x-f5xc-description-medium": "X-displayName: \"Key Field\" Security events can be aggregated based on these fields. - CITY: x-displayName: \"City\" - COUNTRY: x-displayName: \"Country\" - ASN: x-displayName: \"ASN\" - INCIDENT_TYPE: x-displayName: \"Incident Type\" - INTENT: x-displayName: \"Intent\" - VH_NAME: x-displayName: \"Virtual...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsKeyField",
           "required_fields": [],
@@ -4380,6 +4671,8 @@
           "EVENTS"
         ],
         "default": "EVENTS",
+        "x-f5xc-description-short": "X-displayName: \"Metric Field\" Metrics can be computed based on these fields. - EVENTS: x-displayName: \"Events\".",
+        "x-f5xc-description-medium": "X-displayName: \"Metric Field\" Metrics can be computed based on these fields. - EVENTS: x-displayName: \"Events\".",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsMetricField",
           "required_fields": [],
@@ -4399,6 +4692,8 @@
             "$ref": "#/components/schemas/app_securityincidentsPercentileAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Metrics Aggregation\" Computes metrics based on values for the field in the incident.",
+        "x-f5xc-description-medium": "X-displayName: \"Metrics Aggregation\" Computes metrics based on values for the field in the incident.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsMetricsAggregation",
           "required_fields": [
@@ -4426,6 +4721,8 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nThis option provides sub-aggregation for each field aggregation bucket.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each field aggregation bucket.",
+            "x-f5xc-description-medium": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each field aggregation bucket.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -4439,6 +4736,7 @@
             "title": "Topk",
             "format": "int64",
             "x-f5xc-example": "10",
+            "x-f5xc-description-short": "X-displayName: \"TopK\" Number of top field values to be returned in the response.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -4449,6 +4747,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Multi-Field Aggregation\" Aggregate incidents based on the multiple fields in the incident.",
+        "x-f5xc-description-medium": "X-displayName: \"Multi-Field Aggregation\" Aggregate incidents based on the multiple fields in the incident.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsMultiFieldAggregation",
           "required_fields": [
@@ -4473,6 +4773,8 @@
             "$ref": "#/components/schemas/app_securityincidentsCardinalityAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Multi Field SubAggregation\" Aggregate security events in each MultiTerms bucket based on one of the sub aggregation types.",
+        "x-f5xc-description-medium": "X-displayName: \"Multi Field SubAggregation\" Aggregate security events in each MultiTerms bucket based on one of the sub aggregation types.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsMultiFieldSubAggregation",
           "required_fields": [
@@ -4493,6 +4795,8 @@
           "SRC_IP_TLS_FINGERPRINT"
         ],
         "default": "SRC_IP_TLS_FINGERPRINT",
+        "x-f5xc-description-short": "X-displayName: \"Multi-Key Field\" Security events can be aggregated based on these multiple key fields - SRC_IP_TLS_FINGERPRINT: x-displayName...",
+        "x-f5xc-description-medium": "X-displayName: \"Multi-Key Field\" Security events can be aggregated based on these multiple key fields - SRC_IP_TLS_FINGERPRINT: x-displayName: \"Source IP, JA3 TLS Fingerprint\" Aggregated by (keyfield.src_IP, keyfield.tls_FINGERPRINT).",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsMultiKeyField",
           "required_fields": [],
@@ -4517,6 +4821,7 @@
             "title": "Percent",
             "format": "double",
             "x-f5xc-example": "[99.0]",
+            "x-f5xc-description-short": "X-displayName: \"Percent\" x-required Percentile for which value is calculated.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -4525,6 +4830,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Percentile Aggregation\" Calculates percentile over numeric values for a field.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securityincidentsPercentileAggregation",
           "required_fields": [
@@ -4565,6 +4871,8 @@
             "$ref": "#/components/schemas/suspicious_user_logMinAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Aggregation Request\" Aggregation request to provide analytics data over the log response.",
+        "x-f5xc-description-medium": "X-displayName: \"Aggregation Request\" Aggregation request to provide analytics data over the log response.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitysuspicious_user_logAggregationRequest",
           "required_fields": [
@@ -4592,6 +4900,8 @@
             "$ref": "#/components/schemas/app_securitysuspicious_user_logKeyField"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Cardinality Aggregation\" GET approximate count of distinct values for the field in the suspicious user log.",
+        "x-f5xc-description-medium": "X-displayName: \"Cardinality Aggregation\" GET approximate count of distinct values for the field in the suspicious user log.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitysuspicious_user_logCardinalityAggregation",
           "required_fields": [
@@ -4614,6 +4924,8 @@
             "description": "X-displayName: \"Step\"\nx-required\nstep is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response.\nThe timestamps in the response will be t1=start_time, t2=t1+step, ... Tn=tn-1+step, where tn <= end_time.\nFormat: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days.",
             "title": "Step",
             "x-f5xc-example": "5m",
+            "x-f5xc-description-short": "X-displayName: \"Step\" x-required step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in...",
+            "x-f5xc-description-medium": "X-displayName: \"Step\" x-required step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response. The timestamps in the response will be t1=start_time, t2=t1+step, ... Tn=tn-1+step, where tn <= end_time.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -4624,6 +4936,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Date Aggregation\" Aggregate suspicious user logs based on timestamp in the log.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitysuspicious_user_logDateAggregation",
           "required_fields": [
@@ -4651,6 +4964,8 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nThis option provides sub-aggregation for each field aggregation bucket.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each field aggregation bucket.",
+            "x-f5xc-description-medium": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each field aggregation bucket.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -4664,6 +4979,7 @@
             "title": "Topk",
             "format": "int64",
             "x-f5xc-example": "10",
+            "x-f5xc-description-short": "X-displayName: \"TopK\" Number of top field values to be returned in the response.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -4674,6 +4990,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field Aggregation\" Aggregate incidents based on the key fields in the suspicious user log.",
+        "x-f5xc-description-medium": "X-displayName: \"Field Aggregation\" Aggregate incidents based on the key fields in the suspicious user log.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitysuspicious_user_logFieldAggregation",
           "required_fields": [
@@ -4698,6 +5016,8 @@
             "$ref": "#/components/schemas/app_securitysuspicious_user_logCardinalityAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field SubAggregation\" Aggregate security events in each field bucket based on one of the sub aggregation types.",
+        "x-f5xc-description-medium": "X-displayName: \"Field SubAggregation\" Aggregate security events in each field bucket based on one of the sub aggregation types.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitysuspicious_user_logFieldSubAggregation",
           "required_fields": [
@@ -4725,6 +5045,8 @@
           "SUSPICION_LOG_TYPE"
         ],
         "default": "CITY",
+        "x-f5xc-description-short": "X-displayName: \"Key Field\" Security events can be aggregated based on these fields. - CITY: x-displayName: \"City\" - COUNTRY: x-displayName...",
+        "x-f5xc-description-medium": "X-displayName: \"Key Field\" Security events can be aggregated based on these fields. - CITY: x-displayName: \"City\" - COUNTRY: x-displayName: \"Country\" - ASN: x-displayName: \"ASN\" - USER: x-displayName: \"User\" - THREAT_LEVEL: x-displayName: \"Threat Level\" - VH_NAME: x-displayName: \"Virtual Host...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitysuspicious_user_logKeyField",
           "required_fields": [],
@@ -4744,6 +5066,8 @@
             "$ref": "#/components/schemas/app_securitysuspicious_user_logPercentileAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Metrics Aggregation\" Computes metrics based on values for the field in the suspicious user log.",
+        "x-f5xc-description-medium": "X-displayName: \"Metrics Aggregation\" Computes metrics based on values for the field in the suspicious user log.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitysuspicious_user_logMetricsAggregation",
           "required_fields": [
@@ -4770,6 +5094,7 @@
             "title": "Percent",
             "format": "double",
             "x-f5xc-example": "[99.0]",
+            "x-f5xc-description-short": "X-displayName: \"Percent\" x-required Percentile for which value is calculated.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -4778,6 +5103,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Percentile Aggregation\" Calculates percentile over numeric values for a field.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for app_securitysuspicious_user_logPercentileAggregation",
           "required_fields": [
@@ -4823,6 +5149,7 @@
               "ves.io.schema.rules.repeated.max_items": "64",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "Sources that are located in one of the countries in the given list.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -4882,6 +5209,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.timestamp.within.seconds": "31536000"
             },
+            "x-f5xc-description-short": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired.",
+            "x-f5xc-description-medium": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in the configuration but is not applied anymore.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -4898,6 +5227,7 @@
             "$ref": "#/components/schemas/schemaMessageMetaType"
           }
         },
+        "x-f5xc-description-short": "DDoS Mitigation Rule specifies the sources to be blocked.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_securityDDoSMitigationRule",
           "required_fields": [
@@ -4950,6 +5280,7 @@
               "ves.io.schema.rules.string.max_len": "1024",
               "ves.io.schema.rules.string.templated_http_path": "true"
             },
+            "x-f5xc-description-short": "The endpoint (path) of the request. Required: YES.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -4983,6 +5314,7 @@
               "ves.io.schema.rules.string.max_len": "128",
               "ves.io.schema.rules.string.vh_domain": "true"
             },
+            "x-f5xc-description-short": "Exclusive with [any_domain] The rule will apply for a specific domain. For",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -4992,6 +5324,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "API Protection Rule for a specific endpoint.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafAPIEndpointProtectionRule",
           "required_fields": [
@@ -5026,6 +5359,7 @@
             "$ref": "#/components/schemas/schemaEmpty"
           }
         },
+        "x-f5xc-description-short": "The action to take if the input request matches the rule.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafAPIProtectionRuleAction",
           "required_fields": [
@@ -5148,6 +5482,7 @@
               "ves.io.schema.rules.string.max_len": "1024",
               "ves.io.schema.rules.string.templated_http_path": "true"
             },
+            "x-f5xc-description-short": "The endpoint (path) of the request. Required: YES.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -5182,6 +5517,7 @@
               "ves.io.schema.rules.string.max_len": "128",
               "ves.io.schema.rules.string.vh_domain": "true"
             },
+            "x-f5xc-description-short": "Exclusive with [any_domain] The rule will apply for a specific domain.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -5228,6 +5564,7 @@
         "default": "SKIP_PROCESSING_WAF",
         "x-displayname": "Action",
         "x-ves-proto-enum": "ves.io.schema.views.common_waf.ClientSrcRuleAction",
+        "x-f5xc-description-short": "Action that should be taken when client identifier matches the rule.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafClientSrcRuleAction",
           "required_fields": [],
@@ -5265,6 +5602,7 @@
               "ves.io.schema.rules.repeated.max_items": "15",
               "ves.io.schema.rules.repeated.unique_metadata_name": "true"
             },
+            "x-f5xc-example": "{\"key\": \"value\"}",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -5320,6 +5658,7 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.max_len": "128"
             },
+            "x-f5xc-description-short": "Exclusive with [api_endpoint base_path] The API group which this validation applies to.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -5344,6 +5683,7 @@
               "ves.io.schema.rules.string.http_path": "true",
               "ves.io.schema.rules.string.max_len": "128"
             },
+            "x-f5xc-description-short": "Exclusive with [api_endpoint api_group] The base path which this validation applies to.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -5356,6 +5696,7 @@
             "$ref": "#/components/schemas/schemaMessageMetaType"
           }
         },
+        "x-f5xc-description-short": "Fall Through Rule for a specific endpoint, base-path, or API group.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafFallThroughRule",
           "required_fields": [
@@ -5399,6 +5740,8 @@
               "ves.io.schema.rules.message.required": "true",
               "ves.io.schema.rules.repeated.max_items": "16"
             },
+            "x-f5xc-example": "{\"key\": \"value\"}",
+            "x-f5xc-description-short": "List of HTTP header name and value pairs Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -5448,6 +5791,8 @@
               "ves.io.schema.rules.uint32.gt": "0",
               "ves.io.schema.rules.uint32.lte": "8192"
             },
+            "x-f5xc-description-short": "The total number of allowed requests for 1 unit (e.g. SECOND/MINUTE/HOUR etc.) of the specified period.",
+            "x-f5xc-description-medium": "The total number of allowed requests for 1 unit (e.g. SECOND/MINUTE/HOUR etc.) of the specified period. Required: YES.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -5495,6 +5840,8 @@
           }
         },
         "x-required": true,
+        "x-f5xc-description-short": "Determine what to do with unprotected endpoints (not in the OpenAPI specification file (a.k.a.",
+        "x-f5xc-description-medium": "Determine what to do with unprotected endpoints (not in the OpenAPI specification file (a.k.a. Swagger) or doesn't have a specific rule in custom rules).",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafOpenApiFallThroughMode",
           "required_fields": [
@@ -5563,6 +5910,8 @@
             "$ref": "#/components/schemas/schemaEmpty"
           }
         },
+        "x-f5xc-description-short": "OpenAPI specification validation settings relevant for \"API Inventory\" enforcement and for \"Custom list\" enforcement.",
+        "x-f5xc-description-medium": "OpenAPI specification validation settings relevant for \"API Inventory\" enforcement and for \"Custom list\" enforcement.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafOpenApiValidationCommonSettings",
           "required_fields": [
@@ -5601,6 +5950,8 @@
           }
         },
         "x-required": true,
+        "x-f5xc-description-short": "Validation mode of OpenAPI specification.",
+        "x-f5xc-description-medium": "Validation mode of OpenAPI specification. When a validation mismatch occurs on a request to one of the endpoints listed on the OpenAPI specification file (a.k.a. Swagger).",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafOpenApiValidationMode",
           "required_fields": [
@@ -5654,6 +6005,8 @@
               "ves.io.schema.rules.repeated.min_items": "1",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of properties of the request to validate according to the OpenAPI specification file (a.k.a.",
+            "x-f5xc-description-medium": "List of properties of the request to validate according to the OpenAPI specification file (a.k.a. Swagger) Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -5714,6 +6067,8 @@
               "ves.io.schema.rules.repeated.min_items": "1",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of properties of the response to validate according to the OpenAPI specification file (a.k.a.",
+            "x-f5xc-description-medium": "List of properties of the response to validate according to the OpenAPI specification file (a.k.a. Swagger) Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -5765,6 +6120,7 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.max_len": "128"
             },
+            "x-f5xc-description-short": "Exclusive with [api_endpoint base_path] The API group which this validation applies to.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -5789,6 +6145,7 @@
               "ves.io.schema.rules.string.http_path": "true",
               "ves.io.schema.rules.string.max_len": "128"
             },
+            "x-f5xc-description-short": "Exclusive with [api_endpoint api_group] The base path which this validation applies to.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -5814,6 +6171,7 @@
               "ves.io.schema.rules.string.max_len": "128",
               "ves.io.schema.rules.string.vh_domain": "true"
             },
+            "x-f5xc-description-short": "Exclusive with [any_domain] The rule will apply for a specific domain.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -5826,6 +6184,7 @@
             "$ref": "#/components/schemas/common_wafOpenApiValidationMode"
           }
         },
+        "x-f5xc-description-short": "OpenAPI Validation Rule for a specific endpoint, base-path, or API group.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafOpenApiValidationRule",
           "required_fields": [
@@ -5872,6 +6231,7 @@
               "ves.io.schema.rules.repeated.max_items": "10",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "Actions that should be taken when client identifier matches the rule.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -5895,6 +6255,8 @@
               "ves.io.schema.rules.uint32.gte": "1",
               "ves.io.schema.rules.uint32.lte": "401308"
             },
+            "x-f5xc-description-short": "Exclusive with [http_header ip_prefix ipv6_prefix user_identifier] RFC 6793 defined 4-byte AS number.",
+            "x-f5xc-description-medium": "Exclusive with [http_header ip_prefix ipv6_prefix user_identifier] RFC 6793 defined 4-byte AS number.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -5921,6 +6283,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.timestamp.within.seconds": "31536000"
             },
+            "x-f5xc-description-short": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired.",
+            "x-f5xc-description-medium": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in the configuration but is not applied anymore.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -5946,6 +6310,7 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.ipv4_prefix": "true"
             },
+            "x-f5xc-description-short": "Exclusive with [as_number http_header ipv6_prefix user_identifier] IPv4 prefix string.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -5968,6 +6333,7 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.ipv6_prefix": "true"
             },
+            "x-f5xc-description-short": "Exclusive with [as_number http_header ip_prefix user_identifier] IPv6 prefix string.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -5995,6 +6361,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.max_len": "256"
             },
+            "x-f5xc-description-short": "Exclusive with [as_number http_header ip_prefix ipv6_prefix] Identify user based on user identifier.",
+            "x-f5xc-description-medium": "Exclusive with [as_number http_header ip_prefix ipv6_prefix] Identify user based on user identifier. User identifier value needs to be copied from security event.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -6008,6 +6376,7 @@
             "$ref": "#/components/schemas/schemaEmpty"
           }
         },
+        "x-f5xc-description-short": "Simple client source rule specifies the sources to be blocked or trusted (skip WAF).",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafSimpleClientSrcRule",
           "required_fields": [
@@ -6065,6 +6434,7 @@
             "$ref": "#/components/schemas/schemaEmpty"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Validation Settings For Headers\" Custom settings for headers validation.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafValidationSettingForHeaders",
           "required_fields": [
@@ -6093,6 +6463,7 @@
             "$ref": "#/components/schemas/schemaEmpty"
           }
         },
+        "x-f5xc-description-short": "Custom settings for query parameters validation.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for common_wafValidationSettingForQueryParameters",
           "required_fields": [
@@ -6148,6 +6519,8 @@
               "ves.io.schema.rules.repeated.min_items": "1",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of JSON Path field values. Use square brackets with an underscore [_] to indicate array elements (e.g., person.emails[_]).",
+            "x-f5xc-description-medium": "List of JSON Path field values. Use square brackets with an underscore [_] to indicate array elements (e.g., person.emails[_]). To reference JSON keys that contain spaces, enclose the entire path in double quotes.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -6209,6 +6582,7 @@
             "$ref": "#/components/schemas/schemaEmpty"
           }
         },
+        "x-f5xc-description-short": "Settings to mask sensitive data in request/response payload.",
         "x-f5xc-minimum-configuration": {
           "description": "HTTP/HTTPS load balancer for distributing traffic across origin pools",
           "required_fields": [
@@ -6264,6 +6638,7 @@
               "ves.io.schema.rules.string.max_bytes": "256",
               "ves.io.schema.rules.string.not_empty": "true"
             },
+            "x-f5xc-description-short": "Exclusive with [presence regex] Header value to match exactly.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -6278,6 +6653,7 @@
             "title": "Invert_match.",
             "format": "boolean",
             "x-displayname": "NOT of match.",
+            "x-f5xc-description-short": "Invert the result of the match to detect missing header or non-matching value.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -6315,7 +6691,7 @@
             },
             "x-original-maxLength": 256,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909234+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793377+00:00"
           },
           "presence": {
             "type": "boolean",
@@ -6323,6 +6699,7 @@
             "title": "Presence",
             "format": "boolean",
             "x-displayname": "Presence",
+            "x-f5xc-description-short": "Exclusive with [exact regex] If true, check for presence of header.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -6346,6 +6723,7 @@
               "ves.io.schema.rules.string.not_empty": "true",
               "ves.io.schema.rules.string.regex": "true"
             },
+            "x-f5xc-description-short": "Exclusive with [exact presence] Regex match of the header value in re2 format.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -6355,6 +6733,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "Header match is done using the name of the header and its value.",
+        "x-f5xc-description-medium": "Header match is done using the name of the header and its value. The value match is done using one of the following regex match on value exact match of value presence of header Header Match can also be inverse of above, which be used to check missing header or non-matching value.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for ioschemaHeaderMatcherType",
           "required_fields": [
@@ -6385,6 +6765,8 @@
             "x-displayname": "Kind",
             "x-ves-example": "Virtual_site.",
             "x-f5xc-example": "virtual_site",
+            "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object's kind (e.g. \"route\")",
+            "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object's kind (e.g. \"route\").",
             "minLength": 0,
             "maxLength": 14,
             "x-f5xc-required-for": {
@@ -6396,7 +6778,7 @@
             "readOnly": true,
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909242+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793385+00:00"
           },
           "name": {
             "type": "string",
@@ -6405,6 +6787,8 @@
             "x-displayname": "Name",
             "x-ves-example": "Contactus-route.",
             "x-f5xc-example": "contactus-route",
+            "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g.",
+            "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. Route's) name.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -6415,7 +6799,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909247+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793389+00:00"
           },
           "namespace": {
             "type": "string",
@@ -6424,6 +6808,8 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Ns1",
             "x-f5xc-example": "ns1",
+            "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g.",
+            "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. Route's) namespace.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -6434,7 +6820,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909251+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793393+00:00"
           },
           "tenant": {
             "type": "string",
@@ -6443,6 +6829,8 @@
             "x-displayname": "Tenant",
             "x-ves-example": "Example-corp.",
             "x-f5xc-example": "example-corp",
+            "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g.",
+            "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. Route's) tenant.",
             "minLength": 0,
             "maxLength": 18,
             "x-f5xc-required-for": {
@@ -6455,7 +6843,7 @@
             "x-field-mutability": "read-only",
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909255+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793397+00:00"
           },
           "uid": {
             "type": "string",
@@ -6464,6 +6852,8 @@
             "x-displayname": "UID",
             "x-ves-example": "D15f1fad-4d37-48c0-8706-df1824d76d31.",
             "x-f5xc-example": "d15f1fad-4d37-48c0-8706-df1824d76d31",
+            "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object's(e.g.",
+            "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object's(e.g. Route's) uid.",
             "minLength": 0,
             "maxLength": 36,
             "x-f5xc-required-for": {
@@ -6477,9 +6867,11 @@
             "x-original-maxLength": 1024,
             "format": "uuid",
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909260+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793403+00:00"
           }
         },
+        "x-f5xc-description-short": "Type establishes a 'direct reference' from one object(the referrer) to another(the referred).",
+        "x-f5xc-description-medium": "Type establishes a 'direct reference' from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for ioschemaObjectRefType",
           "required_fields": [
@@ -6515,9 +6907,10 @@
             "maxLength": 15,
             "minLength": 3,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909266+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793409+00:00"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Avg Aggregation Data\" Average Aggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logAvgAggregationData",
           "required_fields": [
@@ -6540,6 +6933,7 @@
             "description": "X-displayName: \"Count\"\nx-example: 100\nCount of distinct values of a log field.",
             "title": "Count",
             "format": "uint64",
+            "x-f5xc-example": "42",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -6553,6 +6947,8 @@
             "$ref": "#/components/schemas/schemaTrendValue"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Cardinality Aggregation Data\" Approximate count of distinct values of the log field specified in the request.",
+        "x-f5xc-description-medium": "X-displayName: \"Cardinality Aggregation Data\" Approximate count of distinct values of the log field specified in the request.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logCardinalityAggregationData",
           "required_fields": [
@@ -6576,6 +6972,7 @@
             "description": "X-displayName: \"Count\"\nx-example: 45\n\nnumber of logs in this bucket.",
             "title": "Count",
             "format": "uint64",
+            "x-f5xc-example": "42",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -6589,6 +6986,7 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nSub aggregation data for the date bucket.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" Sub aggregation data for the date bucket.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -6614,6 +7012,8 @@
             "$ref": "#/components/schemas/schemaTrendValue"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Date Aggregation Bucket\" Date histogram bucket containing the timestamp and the number of logs in that bucket.",
+        "x-f5xc-description-medium": "X-displayName: \"Date Aggregation Bucket\" Date histogram bucket containing the timestamp and the number of logs in that bucket.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logDateAggregationBucket",
           "required_fields": [
@@ -6641,6 +7041,7 @@
             "items": {
               "$ref": "#/components/schemas/logDateAggregationBucket"
             },
+            "x-f5xc-description-short": "X-displayName: \"Buckets\" Lists of buckets containing timestamp and the corresponding log count.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -6653,6 +7054,8 @@
             "description": "X-displayName: \"Step\"\nActual step size in the response. It could be higher than the requested step depending on the query duration and/or the log rollups.\nFormat: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days.",
             "title": "Step",
             "x-f5xc-example": "30m",
+            "x-f5xc-description-short": "X-displayName: \"Step\" Actual step size in the response.",
+            "x-f5xc-description-medium": "X-displayName: \"Step\" Actual step size in the response. It could be higher than the requested step depending on the query duration and/or the log rollups. Format: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -6663,6 +7066,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Date Aggregation Data\" Date aggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logDateAggregationData",
           "required_fields": [
@@ -6688,6 +7092,7 @@
             "$ref": "#/components/schemas/logMultiFieldAggregationData"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Date SubAggregation\" Date subaggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logDateSubAggregationData",
           "required_fields": [
@@ -6711,6 +7116,7 @@
             "description": "X-displayName: \"Count\"\nx-example: 45\n\nnumber of logs in this bucket.",
             "title": "Count",
             "format": "uint64",
+            "x-f5xc-example": "42",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -6735,7 +7141,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909289+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793431+00:00"
           },
           "order_by": {
             "$ref": "#/components/schemas/logOrderByData"
@@ -6744,6 +7150,7 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nSub aggregation data for the field aggregation bucket.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" Sub aggregation data for the field aggregation bucket.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -6755,6 +7162,8 @@
             "$ref": "#/components/schemas/schemaTrendValue"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field Aggregation Bucket\" Field aggregation bucket containing field value and the number of logs.",
+        "x-f5xc-description-medium": "X-displayName: \"Field Aggregation Bucket\" Field aggregation bucket containing field value and the number of logs.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logFieldAggregationBucket",
           "required_fields": [
@@ -6783,6 +7192,7 @@
             "items": {
               "$ref": "#/components/schemas/logFieldAggregationBucket"
             },
+            "x-f5xc-description-short": "X-displayName: \"Buckets\" Lists of buckets containing field value and the corresponding log count.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -6791,6 +7201,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field Aggregation Data\" Field Aggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logFieldAggregationData",
           "required_fields": [
@@ -6813,6 +7224,7 @@
             "description": "X-displayName: \"Count\"\nx-example: 45\n\nnumber of logs in this bucket.",
             "title": "Count",
             "format": "uint64",
+            "x-f5xc-example": "42",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -6827,6 +7239,7 @@
             "description": "X-displayName: \"Key\"\nKey contain the name/value pair that identifies the unique key fields.",
             "title": "Keys",
             "x-f5xc-example": "HIT, MISS, REVALIDATED",
+            "x-f5xc-description-short": "X-displayName: \"Key\" Key contain the name/value pair that identifies the unique key fields.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -6837,12 +7250,14 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909302+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793444+00:00"
           },
           "order_by": {
             "$ref": "#/components/schemas/logOrderByData"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field Sub Aggregation Bucket\" Field sub aggregation bucket containing field values and the number of logs.",
+        "x-f5xc-description-medium": "X-displayName: \"Field Sub Aggregation Bucket\" Field sub aggregation bucket containing field values and the number of logs.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logFieldSubAggregationBucket",
           "required_fields": [
@@ -6872,6 +7287,7 @@
             "items": {
               "$ref": "#/components/schemas/logFieldSubAggregationBucket"
             },
+            "x-f5xc-description-short": "X-displayName: \"Buckets\" Lists of buckets containing field values and the corresponding log count.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -6895,6 +7311,7 @@
             "$ref": "#/components/schemas/logMultiFilterAggregationData"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field SubAggregation\" Field subaggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logFieldSubAggregationData",
           "required_fields": [
@@ -6923,6 +7340,7 @@
             "description": "X-displayName: \"Count\"\nx-example: 45\n\nnumber of logs in this bucket.",
             "title": "Count",
             "format": "uint64",
+            "x-f5xc-example": "42",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -6937,6 +7355,7 @@
             "description": "X-displayName: \"Key\"\nKey contain the name/value pair that identifies the unique key fields.",
             "title": "Keys",
             "x-f5xc-example": "HIT, MISS, REVALIDATED",
+            "x-f5xc-description-short": "X-displayName: \"Key\" Key contain the name/value pair that identifies the unique key fields.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -6947,9 +7366,11 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909318+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793459+00:00"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field Sub Field Aggregation Bucket\" Field sub aggregation bucket containing field values and the number of logs.",
+        "x-f5xc-description-medium": "X-displayName: \"Field Sub Field Aggregation Bucket\" Field sub aggregation bucket containing field values and the number of logs.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logFieldSubFieldAggregationBucket",
           "required_fields": [
@@ -6975,6 +7396,7 @@
             "items": {
               "$ref": "#/components/schemas/logFieldSubFieldAggregationBucket"
             },
+            "x-f5xc-description-short": "X-displayName: \"Buckets\" Lists of buckets containing field value and the corresponding log count.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -6983,6 +7405,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field Sub Field Aggregation Data\" Field Aggregation data as Field Sub-aggregation.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logFieldSubFieldAggregationData",
           "required_fields": [
@@ -7005,6 +7428,7 @@
             "description": "X-displayName: \"Count\"\nx-example: 45\n\nnumber of logs in this bucket.",
             "title": "Count",
             "format": "uint64",
+            "x-f5xc-example": "42",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -7018,6 +7442,7 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nSub aggregation data for the filter aggregation.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" Sub aggregation data for the filter aggregation.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7026,6 +7451,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Filter Aggregation Data\" Filter Aggregation Data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logFilterAggregationData",
           "required_fields": [
@@ -7051,6 +7477,7 @@
             "items": {
               "$ref": "#/components/schemas/logFilterSubFieldAggregationBucket"
             },
+            "x-f5xc-description-short": "X-displayName: \"Buckets\" Lists of buckets containing field value and the corresponding log count.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7059,6 +7486,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"FilterSubAggregation\" Filter subaggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logFilterSubAggregationData",
           "required_fields": [
@@ -7081,6 +7509,7 @@
             "description": "X-displayName: \"Count\"\nx-example: 45\n\nnumber of logs in this bucket.",
             "title": "Count",
             "format": "uint64",
+            "x-f5xc-example": "42",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -7095,6 +7524,7 @@
             "description": "X-displayName: \"Key\"\nKey contain the name/value pair that identifies the unique key fields.",
             "title": "Keys",
             "x-f5xc-example": "HIT, MISS, REVALIDATED",
+            "x-f5xc-description-short": "X-displayName: \"Key\" Key contain the name/value pair that identifies the unique key fields.",
             "minLength": 0,
             "maxLength": 16,
             "x-f5xc-required-for": {
@@ -7105,12 +7535,13 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909332+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793472+00:00"
           },
           "sub_aggs": {
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nSub aggregation data for the filter aggregation.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" Sub aggregation data for the filter aggregation.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7119,6 +7550,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Filter Sub Field Aggregation Bucket\" Field sub aggregation bucket containing field values and the number of logs.",
+        "x-f5xc-description-medium": "X-displayName: \"Filter Sub Field Aggregation Bucket\" Field sub aggregation bucket containing field values and the number of logs.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logFilterSubFieldAggregationBucket",
           "required_fields": [
@@ -7169,6 +7602,7 @@
             "$ref": "#/components/schemas/logMultiFilterAggregationData"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Log Aggregation\" Log aggregation response data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logLogAggregationData",
           "required_fields": [
@@ -7209,9 +7643,10 @@
             "maxLength": 15,
             "minLength": 3,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909352+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793489+00:00"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Max Aggregation Data\" Max Aggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logMaxAggregationData",
           "required_fields": [
@@ -7233,6 +7668,7 @@
             "$ref": "#/components/schemas/logPercentileAggregationData"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Metrics Aggregation\" Metrics aggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logMetricsAggregationData",
           "required_fields": [
@@ -7264,9 +7700,10 @@
             "maxLength": 15,
             "minLength": 3,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909359+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793496+00:00"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Min Aggregation Data\" Min Aggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logMinAggregationData",
           "required_fields": [
@@ -7289,6 +7726,7 @@
             "description": "X-displayName: \"Count\"\nx-example: 45\n\nnumber of logs in this bucket.",
             "title": "Count",
             "format": "uint64",
+            "x-f5xc-example": "42",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -7303,6 +7741,8 @@
             "description": "X-displayName: \"Keys\"\nKeys contain the name/value pair that identifies the unique combination of multiple key fields\nSRC_IP\": \"10.10.10.1\", \"COUNTRY\": \"US\"}\"",
             "title": "Keys",
             "x-f5xc-example": "{",
+            "x-f5xc-description-short": "X-displayName: \"Keys\" Keys contain the name/value pair that identifies the unique combination of multiple key fields SRC_IP\": \"10.10.10.1\"...",
+            "x-f5xc-description-medium": "X-displayName: \"Keys\" Keys contain the name/value pair that identifies the unique combination of multiple key fields SRC_IP\": \"10.10.10.1\", \"COUNTRY\": \"US\"}\".",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7317,6 +7757,7 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nSub aggregation data for the multi field aggregation bucket.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" Sub aggregation data for the multi field aggregation bucket.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7325,6 +7766,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Multi-Field Aggregation Bucket\" Multi-Field aggregation bucket containing field values and the number of logs.",
+        "x-f5xc-description-medium": "X-displayName: \"Multi-Field Aggregation Bucket\" Multi-Field aggregation bucket containing field values and the number of logs.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logMultiFieldAggregationBucket",
           "required_fields": [
@@ -7352,6 +7795,7 @@
             "items": {
               "$ref": "#/components/schemas/logMultiFieldAggregationBucket"
             },
+            "x-f5xc-description-short": "X-displayName: \"Buckets\" Lists of buckets containing field values and the corresponding log count.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7360,6 +7804,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Multi-Field Aggregation Data\" Multi-Field Aggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logMultiFieldAggregationData",
           "required_fields": [
@@ -7393,6 +7838,7 @@
             "$ref": "#/components/schemas/logTopHitsAggregationData"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Multi Field SubAggregation\" Field subaggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logMultiFieldSubAggregationData",
           "required_fields": [
@@ -7419,6 +7865,7 @@
             "description": "X-displayName: \"Count\"\nx-example: 45\n\nnumber of logs in this bucket.",
             "title": "Count",
             "format": "uint64",
+            "x-f5xc-example": "42",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -7429,6 +7876,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Multi Filter Aggregation Data\" Multi Filter Aggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logMultiFilterAggregationData",
           "required_fields": [
@@ -7450,6 +7898,7 @@
             "$ref": "#/components/schemas/logMetricsAggregationData"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Order by Data\" Order by data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logOrderByData",
           "required_fields": [
@@ -7472,6 +7921,7 @@
             "description": "X-displayName: \"Key\"\nx-example: 99.0.",
             "title": "Key",
             "format": "double",
+            "x-f5xc-example": "[REDACTED_PUBLIC_KEY]",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7481,7 +7931,7 @@
             "maxLength": 16,
             "minLength": 7,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909383+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793530+00:00"
           },
           "value": {
             "type": "number",
@@ -7497,9 +7947,10 @@
             "maxLength": 15,
             "minLength": 3,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909389+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793535+00:00"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Percentile Aggregation Data\" Percentile Aggregation data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logPercentileAggregationData",
           "required_fields": [
@@ -7523,6 +7974,7 @@
             "description": "X-displayName: \"Count\"\nx-example: 100\nCount of top hit values.",
             "title": "Count",
             "format": "uint64",
+            "x-f5xc-example": "42",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -7539,6 +7991,7 @@
             "items": {
               "type": "string"
             },
+            "x-f5xc-description-short": "X-displayName: \"Documents\" document values.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7547,6 +8000,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"TopHits Aggregation Data\" Top Hits Aggregation Data.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for logTopHitsAggregationData",
           "required_fields": [
@@ -7586,6 +8040,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "SecurityEventsCounter contains the timeseries data of security events counter.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for metricsSecurityEventsCounter",
           "required_fields": [
@@ -7613,6 +8068,7 @@
             "x-displayname": "Namespace",
             "x-ves-example": "Blogging-app-namespace-1.",
             "x-f5xc-example": "blogging-app-namespace-1",
+            "x-f5xc-description-short": "Namespace for which the security event was generated.",
             "minLength": 0,
             "maxLength": 6,
             "x-f5xc-required-for": {
@@ -7623,11 +8079,11 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909402+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793546+00:00"
           },
           "sec_event_type": {
             "type": "string",
-            "description": "",
+            "description": "Event or occurrence data",
             "title": "Security Event Type.",
             "x-displayname": "Security Event Type.",
             "x-ves-example": "WAF",
@@ -7643,7 +8099,7 @@
           },
           "src_instance": {
             "type": "string",
-            "description": "",
+            "description": "Instance or deployment identifier",
             "title": "Source Instance.",
             "x-displayname": "Source Instance.",
             "x-ves-example": "IN",
@@ -7659,7 +8115,7 @@
           },
           "src_site": {
             "type": "string",
-            "description": "",
+            "description": "Site or location identifier",
             "title": "Source Site.",
             "x-displayname": "Source Site.",
             "x-ves-example": "Greatblogs-CE.",
@@ -7675,7 +8131,7 @@
           },
           "vh_name": {
             "type": "string",
-            "description": "",
+            "description": "Human-readable name for the resource",
             "title": "Virtual Host.",
             "x-displayname": "Virtual Host.",
             "x-ves-example": "Greatblogs-vhost.",
@@ -7690,6 +8146,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "SecurityEventsId uniquely identifies an entry in the response for security events metrics query.",
+        "x-f5xc-description-medium": "SecurityEventsId uniquely identifies an entry in the response for security events metrics query. Security events counter is aggregated based on the MetricLabel specified in the group_by field in the request. Therefore, only the fields that corresponds to the MetricLabel in the group_by will have...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for metricsSecurityEventsId",
           "required_fields": [
@@ -7719,6 +8177,8 @@
         "default": "NAMESPACE",
         "x-displayname": "Security Events Metric Labels.",
         "x-ves-proto-enum": "ves.io.schema.app_security.metrics.SecurityMetricLabel",
+        "x-f5xc-description-short": "Labels in the security events metrics. Security events metric can be sliced and diced based on one or more labels listed below.",
+        "x-f5xc-description-medium": "Labels in the security events metrics. Security events metric can be sliced and diced based on one or more labels listed below.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for metricsSecurityMetricLabel",
           "required_fields": [],
@@ -7758,9 +8218,11 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909416+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793559+00:00"
           }
         },
+        "x-f5xc-description-short": "Label based filtering for Security Events metrics. Security Events metrics are tagged with labels mentioned in MetricLabel.",
+        "x-f5xc-description-medium": "Label based filtering for Security Events metrics. Security Events metrics are tagged with labels mentioned in MetricLabel. Metric label filter can be specified to query specific metrics based on label match.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for metricsSecurityMetricLabelFilter",
           "required_fields": [
@@ -7786,6 +8248,7 @@
         "default": "EQ",
         "x-displayname": "Security Events Metric Label Operator.",
         "x-ves-proto-enum": "ves.io.schema.app_security.metrics.SecurityMetricLabelOp",
+        "x-f5xc-description-short": "The operator to use when querying Security Events metrics with labels.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for metricsSecurityMetricLabelOp",
           "required_fields": [],
@@ -7820,7 +8283,7 @@
           },
           "value": {
             "type": "string",
-            "description": "Value",
+            "description": "Configuration parameter for value",
             "title": "Value",
             "x-displayname": "Value",
             "x-ves-example": "15",
@@ -7835,9 +8298,10 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909423+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793565+00:00"
           }
         },
+        "x-f5xc-description-short": "Value returned for a Security Events Metrics query.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for metricsSecurityMetricValue",
           "required_fields": [
@@ -7875,6 +8339,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.max_len": "128"
             },
+            "x-f5xc-description-short": "Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check.",
+            "x-f5xc-description-medium": "Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*).",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -7887,6 +8353,7 @@
             "$ref": "#/components/schemas/app_firewallAttackType"
           }
         },
+        "x-f5xc-description-short": "App Firewall Attack Type context changes to be applied for this request.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyAppFirewallAttackTypeContext",
           "required_fields": [
@@ -7925,6 +8392,7 @@
               "ves.io.schema.rules.repeated.max_items": "64",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "Attack Types to be excluded for the defined match criteria.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7949,6 +8417,8 @@
               "ves.io.schema.rules.repeated.max_items": "64",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-example": "example-resource",
+            "x-f5xc-description-short": "Bot Names to be excluded for the defined match criteria.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7973,6 +8443,7 @@
               "ves.io.schema.rules.repeated.max_items": "1024",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "Signature IDs to be excluded for the defined match criteria.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -7997,6 +8468,7 @@
               "ves.io.schema.rules.repeated.max_items": "64",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "Violations to be excluded for the defined match criteria.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -8005,6 +8477,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "Define the list of Signature IDs, Violations, Attack Types and Bot Names that should be excluded from triggering on the defined match criteria.",
+        "x-f5xc-description-medium": "Define the list of Signature IDs, Violations, Attack Types and Bot Names that should be excluded from triggering on the defined match criteria.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyAppFirewallDetectionControl",
           "required_fields": [
@@ -8044,6 +8518,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.max_len": "128"
             },
+            "x-f5xc-description-short": "Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check.",
+            "x-f5xc-description-medium": "Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*).",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -8071,6 +8547,8 @@
               "ves.io.schema.rules.uint32.gte": "0",
               "ves.io.schema.rules.uint32.lte": "299999999"
             },
+            "x-f5xc-description-short": "The allowed values for signature ID are 0 and in the range of 200000001-299999999. 0 implies that all signatures will be excluded for the...",
+            "x-f5xc-description-medium": "The allowed values for signature ID are 0 and in the range of 200000001-299999999. 0 implies that all signatures will be excluded for the specified context. Required: YES.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -8082,6 +8560,7 @@
             "x-field-mutability": "read-only"
           }
         },
+        "x-f5xc-description-short": "App Firewall signature context changes to be applied for this request.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyAppFirewallSignatureContext",
           "required_fields": [
@@ -8120,6 +8599,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.max_len": "128"
             },
+            "x-f5xc-description-short": "Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check.",
+            "x-f5xc-description-medium": "Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*).",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -8132,6 +8613,7 @@
             "$ref": "#/components/schemas/app_firewallAppFirewallViolationType"
           }
         },
+        "x-f5xc-description-short": "App Firewall violation context changes to be applied for this request.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyAppFirewallViolationContext",
           "required_fields": [
@@ -8179,6 +8661,8 @@
               "ves.io.schema.rules.repeated.min_items": "1",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy.",
+            "x-f5xc-description-medium": "Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer. Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -8187,6 +8671,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy.",
+        "x-f5xc-description-medium": "Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyAsnMatchList",
           "required_fields": [
@@ -8224,6 +8710,7 @@
               "ves.io.schema.rules.message.required": "true",
               "ves.io.schema.rules.repeated.max_items": "4"
             },
+            "x-f5xc-description-short": "List of references to bgp_asn_set objects. Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -8232,6 +8719,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Match any AS number contained in the list of bgp_asn_sets.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyAsnMatcherType",
           "required_fields": [
@@ -8275,6 +8763,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "Specifies bot to be excluded by its name.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyBotNameContext",
           "required_fields": [
@@ -8392,6 +8881,7 @@
               "ves.io.schema.rules.message.required": "true",
               "ves.io.schema.rules.string.max_bytes": "256"
             },
+            "x-f5xc-description-short": "Case-sensitive cookie name. Required: YES.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -8401,9 +8891,11 @@
             },
             "x-original-maxLength": 256,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909473+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793609+00:00"
           }
         },
+        "x-f5xc-description-short": "Cookie matcher specifies the name of a single cookie and the criteria to match it.",
+        "x-f5xc-description-medium": "Cookie matcher specifies the name of a single cookie and the criteria to match it. The input has a list of values for each cookie in the request. A cookie matcher can check for one of the following: * Presence or absence of the cookie * At least one of the values for the cookie in the request...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyCookieMatcherType",
           "required_fields": [
@@ -8711,6 +9203,8 @@
         "default": "CONTEXT_ANY",
         "x-displayname": "WAF Exclusion Context OPTIONS.",
         "x-ves-proto-enum": "ves.io.schema.policy.DetectionContext",
+        "x-f5xc-description-short": "The available contexts for Exclusion rules. - CONTEXT_ANY: CONTEXT_ANY Detection will be excluded for all contexts. - CONTEXT_BODY: CONTEXT_BODY...",
+        "x-f5xc-description-medium": "The available contexts for Exclusion rules. - CONTEXT_ANY: CONTEXT_ANY Detection will be excluded for all contexts. - CONTEXT_BODY: CONTEXT_BODY Detection will be excluded for the request body. - CONTEXT_REQUEST: CONTEXT_REQUEST Detection will be excluded for the request. - CONTEXT_RESPONSE...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyDetectionContext",
           "required_fields": [],
@@ -8762,6 +9256,7 @@
               "ves.io.schema.rules.repeated.max_items": "16",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of methods values to match against.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -8770,6 +9265,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "HTTP method matcher specifies a list of methods to match an input HTTP method.",
+        "x-f5xc-description-medium": "HTTP method matcher specifies a list of methods to match an input HTTP method. The match is considered successful if the input method is a member of the list. The result of the match based on the method list is inverted if invert_matcher is true.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyHttpMethodMatcherType",
           "required_fields": [
@@ -8804,6 +9301,8 @@
         "default": "SPAM_SOURCES",
         "x-displayname": "IP Threat Category.",
         "x-ves-proto-enum": "ves.io.schema.policy.IPThreatCategory",
+        "x-f5xc-description-short": "The IP threat categories to use when a policy based IP threat category is configured. - SPAM_SOURCES: SPAM_SOURCES - WINDOWS_EXPLOITS...",
+        "x-f5xc-description-medium": "The IP threat categories to use when a policy based IP threat category is configured. - SPAM_SOURCES: SPAM_SOURCES - WINDOWS_EXPLOITS: WINDOWS_EXPLOITS - WEB_ATTACKS: WEB_ATTACKS - BOTNETS: BOTNETS - SCANNERS: SCANNERS - REPUTATION: REPUTATION - PHISHING: PHISHING - PROXY: PROXY ...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyIPThreatCategory",
           "required_fields": [],
@@ -8852,6 +9351,7 @@
               "ves.io.schema.rules.message.required": "true",
               "ves.io.schema.rules.repeated.max_items": "4"
             },
+            "x-f5xc-description-short": "List of references to ip_prefix_set objects. Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -8860,6 +9360,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "Match any IP prefix contained in the list of ip_prefix_sets. The result of the match is inverted if invert_matcher is true.",
+        "x-f5xc-description-medium": "Match any IP prefix contained in the list of ip_prefix_sets. The result of the match is inverted if invert_matcher is true.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyIpMatcherType",
           "required_fields": [
@@ -8899,6 +9401,7 @@
               "ves.io.schema.rules.repeated.max_items": "16",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of exact JA4 TLS fingerprint to match the input JA4 TLS fingerprint against.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -8907,6 +9410,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "Extended version of JA3 that includes additional fields for more comprehensive fingerprinting of SSL/TLS clients and potentially has a different...",
+        "x-f5xc-description-medium": "Extended version of JA3 that includes additional fields for more comprehensive fingerprinting of SSL/TLS clients and potentially has a different structure and length.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyJA4TlsFingerprintMatcherType",
           "required_fields": [
@@ -8976,9 +9481,11 @@
             },
             "x-original-maxLength": 256,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909494+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793627+00:00"
           }
         },
+        "x-f5xc-description-short": "JWT claim matcher specifies the name of a single JWT claim and the criteria for the input request to match it.",
+        "x-f5xc-description-medium": "JWT claim matcher specifies the name of a single JWT claim and the criteria for the input request to match it. The input has a list of actual values for each JWT claim name in the JWT payload. A JWT claim matcher can check for one of the following: * Presence or absence of the JWT Claim in the...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyJWTClaimMatcherType",
           "required_fields": [
@@ -9018,6 +9525,8 @@
         "default": "TLS_FINGERPRINT_NONE",
         "x-displayname": "TLS known fingerprint class.",
         "x-ves-proto-enum": "ves.io.schema.policy.KnownTlsFingerprintClass",
+        "x-f5xc-description-short": "Specifies known TLS fingerprint classes - TLS_FINGERPRINT_NONE: TLS_FINGERPRINT_NONE No TLS fingerprint - ANY_MALICIOUS_FINGERPRINT...",
+        "x-f5xc-description-medium": "Specifies known TLS fingerprint classes - TLS_FINGERPRINT_NONE: TLS_FINGERPRINT_NONE No TLS fingerprint - ANY_MALICIOUS_FINGERPRINT: ANY_MALICIOUS_FINGERPRINT TLS fingerprints known to be associated with malicious clients - ADWARE: ADWARE TLS fingerprints known to be associated with adware ...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyKnownTlsFingerprintClass",
           "required_fields": [],
@@ -9059,6 +9568,7 @@
               "ves.io.schema.rules.repeated.max_items": "64",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of exact values to match the input against.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9092,6 +9602,7 @@
               "ves.io.schema.rules.repeated.max_items": "16",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of regular expressions to match the input against.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9117,6 +9628,7 @@
               "ves.io.schema.rules.repeated.max_items": "9",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "Ordered list of transformers (starting from index 0) to be applied to the path before matching.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9125,6 +9637,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "Matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied.",
+        "x-f5xc-description-medium": "Matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyMatcherType",
           "required_fields": [
@@ -9190,6 +9704,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "List of IP Prefix strings to match against.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyPrefixMatchList",
           "required_fields": [
@@ -9225,6 +9740,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.repeated.max_items": "16"
             },
+            "x-f5xc-description-short": "List of predicates for all cookies that need to be matched.",
+            "x-f5xc-description-medium": "List of predicates for all cookies that need to be matched. The criteria for matching each cookie is described in individual instances of CookieMatcherType. The actual cookie values are extracted from the request API as a list of strings for each cookie name.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9247,6 +9764,9 @@
             "x-validation-rules": {
               "ves.io.schema.rules.repeated.max_items": "16"
             },
+            "x-f5xc-example": "{\"key\": \"value\"}",
+            "x-f5xc-description-short": "List of predicates for various HTTP headers that need to match.",
+            "x-f5xc-description-medium": "List of predicates for various HTTP headers that need to match. The criteria for matching each HTTP header are described in individual HeaderMatcherType instances. The actual HTTP header values are extracted from the request API as a list of strings for each HTTP header type.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9269,6 +9789,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.repeated.max_items": "16"
             },
+            "x-f5xc-description-short": "List of predicates for various JWT claims that need to match.",
+            "x-f5xc-description-medium": "List of predicates for various JWT claims that need to match. The criteria for matching each JWT claim are described in individual JWTClaimMatcherType instances. The actual JWT claims values are extracted from the JWT payload as a list of strings.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9291,6 +9813,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.repeated.max_items": "16"
             },
+            "x-f5xc-description-short": "List of predicates for all query parameters that need to be matched.",
+            "x-f5xc-description-medium": "List of predicates for all query parameters that need to be matched. The criteria for matching each query parameter are described in individual instances of QueryParameterMatcherType. The actual query parameter values are extracted from the request API as a list of strings for each query...",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9353,6 +9877,7 @@
               "ves.io.schema.rules.string.max_len": "256",
               "ves.io.schema.rules.string.min_len": "1"
             },
+            "x-f5xc-description-short": "Exclusive with [any_domain suffix_value] Exact domain name.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9368,6 +9893,8 @@
             "x-displayname": "Expiration Timestamp.",
             "x-ves-example": "2019-12-31:44:34.171543432Z.",
             "x-f5xc-example": "2019-12-31:44:34.171543432Z",
+            "x-f5xc-description-short": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired.",
+            "x-f5xc-description-medium": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in the configuration but is not applied anymore.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -9424,6 +9951,8 @@
               "ves.io.schema.rules.string.http_path": "true",
               "ves.io.schema.rules.string.max_len": "256"
             },
+            "x-f5xc-description-short": "Exclusive with [any_path path_regex] Path prefix to match (e.g. The value / will match on all paths)",
+            "x-f5xc-description-medium": "Exclusive with [any_path path_regex] Path prefix to match (e.g. The value / will match on all paths).",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -9448,6 +9977,8 @@
               "ves.io.schema.rules.string.max_bytes": "256",
               "ves.io.schema.rules.string.regex": "true"
             },
+            "x-f5xc-description-short": "Exclusive with [any_path path_prefix] Define the regex for the path. For example, the regex ^/.*$ will match on all paths.",
+            "x-f5xc-description-medium": "Exclusive with [any_path path_prefix] Define the regex for the path. For example, the regex ^/.*$ will match on all paths.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -9475,6 +10006,8 @@
               "ves.io.schema.rules.string.max_len": "256",
               "ves.io.schema.rules.string.min_len": "1"
             },
+            "x-f5xc-description-short": "Exclusive with [any_domain exact_value] Suffix of domain name e.g \"xyz.com\" will match \"*.xyz.com\" and \"xyz.com\".",
+            "x-f5xc-description-medium": "Exclusive with [any_domain exact_value] Suffix of domain name e.g \"xyz.com\" will match \"*.xyz.com\" and \"xyz.com\".",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9486,6 +10019,8 @@
             "$ref": "#/components/schemas/schemaEmpty"
           }
         },
+        "x-f5xc-description-short": "Simple WAF exclusion rule specifies a simple set of match conditions to be matched to skip a list of WAF detections.",
+        "x-f5xc-description-medium": "Simple WAF exclusion rule specifies a simple set of match conditions to be matched to skip a list of WAF detections.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policySimpleWafExclusionRule",
           "required_fields": [
@@ -9533,6 +10068,7 @@
               "ves.io.schema.rules.repeated.max_items": "16",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of known classes of TLS fingerprints to match the input TLS JA3 fingerprint against.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9561,6 +10097,7 @@
               "ves.io.schema.rules.repeated.max_items": "16",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of exact TLS JA3 fingerprints to match the input TLS JA3 fingerprint against.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9589,6 +10126,8 @@
               "ves.io.schema.rules.repeated.max_items": "32",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-description-short": "List of TLS JA3 fingerprints to be excluded when matching the input TLS JA3 fingerprint.",
+            "x-f5xc-description-medium": "List of TLS JA3 fingerprints to be excluded when matching the input TLS JA3 fingerprint. This can be used to skip known false positives when using one or more known TLS fingerprint classes in the enclosing matcher.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9597,6 +10136,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "TLS fingerprint matcher specifies multiple criteria for matching a TLS fingerprint.",
+        "x-f5xc-description-medium": "TLS fingerprint matcher specifies multiple criteria for matching a TLS fingerprint. The set of supported positve match criteria includes a list of known classes of TLS fingerprints and a list of exact values. The match is considered successful if either of these positive criteria are satisfied...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyTlsFingerprintMatcherType",
           "required_fields": [
@@ -9629,6 +10170,8 @@
         "default": "TRANSFORMER_NONE",
         "x-displayname": "Transformer.",
         "x-ves-proto-enum": "ves.io.schema.policy.Transformer",
+        "x-f5xc-description-short": "Transformers to be applied on the part of the request before matching. - TRANSFORMER_NONE: transformer none No transformers enabled - LOWER_CASE...",
+        "x-f5xc-description-medium": "Transformers to be applied on the part of the request before matching. - TRANSFORMER_NONE: transformer none No transformers enabled - LOWER_CASE: lower case Convert string to lower case - UPPER_CASE: upper case Convert string to upper case - BASE64_DECODE: base64 decode Decode string assuming...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for policyTransformer",
           "required_fields": [],
@@ -9651,6 +10194,8 @@
         "default": "SECOND",
         "x-displayname": "Rate Limit Period Unit.",
         "x-ves-proto-enum": "ves.io.schema.rate_limiter.RateLimitPeriodUnit",
+        "x-f5xc-description-short": "Unit for the period per which the rate limit is applied. - SECOND: Second Rate limit period unit is seconds - MINUTE: Minute Rate limit period...",
+        "x-f5xc-description-medium": "Unit for the period per which the rate limit is applied. - SECOND: Second Rate limit period unit is seconds - MINUTE: Minute Rate limit period unit is minutes - HOUR: Hour Rate limit period unit is hours - DAY: Day Rate limit period unit is days.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for rate_limiterRateLimitPeriodUnit",
           "required_fields": [],
@@ -9667,6 +10212,7 @@
         "title": "Empty",
         "x-displayname": "Empty",
         "x-ves-proto-message": "ves.io.schema.Empty",
+        "x-f5xc-description-short": "Can be used for messages where no values are needed.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaEmpty",
           "required_fields": [],
@@ -9697,6 +10243,7 @@
         "default": "ANY",
         "x-displayname": "HTTP Method.",
         "x-ves-proto-enum": "ves.io.schema.HttpMethod",
+        "x-f5xc-description-short": "Specifies the HTTP method used to access a resource. Any HTTP Method.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaHttpMethod",
           "required_fields": [],
@@ -9742,6 +10289,7 @@
               "ves.io.schema.rules.repeated.items.string.min_len": "1",
               "ves.io.schema.rules.repeated.max_items": "1"
             },
+            "x-f5xc-description-short": "Expressions contains the Kubernetes style label expression for selections. Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -9750,6 +10298,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "Type can be used to establish a 'selector reference' from one object(called selector) to a set of other objects(called selectees) based on the...",
+        "x-f5xc-description-medium": "Type can be used to establish a 'selector reference' from one object(called selector) to a set of other objects(called selectees) based on the value of expresssions. A label selector is a label query over a set of resources. An empty label selector matches all objects.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaLabelSelectorType",
           "required_fields": [
@@ -9792,7 +10342,7 @@
             },
             "x-original-maxLength": 256,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909539+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793668+00:00"
           },
           "name": {
             "type": "string",
@@ -9813,6 +10363,7 @@
               "ves.io.schema.rules.string.min_len": "1",
               "ves.io.schema.rules.string.ves_object_name": "true"
             },
+            "x-f5xc-description-short": "Name of the message. The value of name has to follow DNS-1035 format.",
             "maxLength": 16,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -9822,9 +10373,11 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909544+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793673+00:00"
           }
         },
+        "x-f5xc-description-short": "MessageMetaType is metadata (common attributes) of a message that only certain messages have.",
+        "x-f5xc-description-medium": "MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaMessageMetaType",
           "required_fields": [
@@ -9855,6 +10408,8 @@
         "default": "PROPERTY_QUERY_PARAMETERS",
         "x-displayname": "OpenAPI Validation Properties.",
         "x-ves-proto-enum": "ves.io.schema.OpenApiValidationProperties",
+        "x-f5xc-description-short": "List of required properties to validate against the OpenAPI spec Validate that all query parameters are according to the OpenAPI specification...",
+        "x-f5xc-description-medium": "List of required properties to validate against the OpenAPI spec Validate that all query parameters are according to the OpenAPI specification Validate that all path parameters are according to the OpenAPI specification Validate that the content type of the request is according to the OpenAPI...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaOpenApiValidationProperties",
           "required_fields": [],
@@ -9876,6 +10431,7 @@
         "default": "DESCENDING",
         "x-displayname": "Sort Order.",
         "x-ves-proto-enum": "ves.io.schema.SortOrder",
+        "x-f5xc-description-short": "Sort algorithm Sort in descending order Sort in ascending order.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaSortOrder",
           "required_fields": [],
@@ -9896,6 +10452,8 @@
           "TREND_SENTIMENT_NEGATIVE"
         ],
         "default": "TREND_SENTIMENT_NONE",
+        "x-f5xc-description-short": "X-displayName: \"Trend Sentiment\" trend sentiment - TREND_SENTIMENT_NONE: x-displayName: \"None\" - TREND_SENTIMENT_POSITIVE: x-displayName...",
+        "x-f5xc-description-medium": "X-displayName: \"Trend Sentiment\" trend sentiment - TREND_SENTIMENT_NONE: x-displayName: \"None\" - TREND_SENTIMENT_POSITIVE: x-displayName: \"Positive\" Indicates trend sentiment is positive - TREND_SENTIMENT_NEGATIVE: x-displayName: \"Negative\" Indicates trend sentiment is negative.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaTrendSentiment",
           "required_fields": [],
@@ -9916,6 +10474,7 @@
             "description": "X-displayName: \"Description\"\ndescription of the method used to calculate trend.",
             "title": "Description.",
             "x-f5xc-example": "Trend was calculated by comparing the avg of window size intervals of end-start Time and last window time interval",
+            "x-f5xc-description-short": "X-displayName: \"Description\" description of the method used to calculate trend.",
             "minLength": 0,
             "maxLength": 0,
             "x-f5xc-required-for": {
@@ -9926,7 +10485,7 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909549+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793679+00:00"
           },
           "previous_value": {
             "type": "string",
@@ -9960,9 +10519,11 @@
             },
             "x-original-maxLength": 1024,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909557+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793686+00:00"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Trend Value\" Trend value contains trend value, trend sentiment and trend calculation description and window size.",
+        "x-f5xc-description-medium": "X-displayName: \"Trend Value\" Trend value contains trend value, trend sentiment and trend calculation description and window size.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaTrendValue",
           "required_fields": [
@@ -9997,6 +10558,8 @@
             "description": "Trend value computation requested for the field present in aggregation.\n\nX-displayName: \"Trend calculation requested by the user\"\nTrend value computation requested by the user\nOptional: default is false.",
             "format": "boolean",
             "x-f5xc-example": "true",
+            "x-f5xc-description-short": "Trend value computation requested for the field present in aggregation.",
+            "x-f5xc-description-medium": "Trend value computation requested for the field present in aggregation. X-displayName: \"Trend calculation requested by the user\" Trend value computation requested by the user Optional: default is false.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -10011,6 +10574,8 @@
             "$ref": "#/components/schemas/schemaapp_securityMultiFieldAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Aggregation Request\" Aggregation request to provide analytics data over the security events.",
+        "x-f5xc-description-medium": "X-displayName: \"Aggregation Request\" Aggregation request to provide analytics data over the security events.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityAggregationRequest",
           "required_fields": [
@@ -10037,6 +10602,8 @@
             "$ref": "#/components/schemas/schemaapp_securityKeyField"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Cardinality Aggregation\" GET approximate count of distinct values for the field in the security event.",
+        "x-f5xc-description-medium": "X-displayName: \"Cardinality Aggregation\" GET approximate count of distinct values for the field in the security event.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityCardinalityAggregation",
           "required_fields": [
@@ -10059,6 +10626,8 @@
             "description": "X-displayName: \"Step\"\nx-required\nstep is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response.\nThe timestamps in the response will be t1=start_time, t2=t1+step, ... Tn=tn-1+step, where tn <= end_time.\nFormat: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days.",
             "title": "Step",
             "x-f5xc-example": "5m",
+            "x-f5xc-description-short": "X-displayName: \"Step\" x-required step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in...",
+            "x-f5xc-description-medium": "X-displayName: \"Step\" x-required step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response. The timestamps in the response will be t1=start_time, t2=t1+step, ... Tn=tn-1+step, where tn <= end_time.",
             "minLength": 0,
             "maxLength": 1024,
             "x-f5xc-required-for": {
@@ -10072,6 +10641,7 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nThis option provides sub-aggregation for each date bucket.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each date bucket.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -10080,6 +10650,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Date Aggregation\" Aggregate security events based on timestamp in the security event.",
+        "x-f5xc-description-medium": "X-displayName: \"Date Aggregation\" Aggregate security events based on timestamp in the security event.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityDateAggregation",
           "required_fields": [
@@ -10105,6 +10677,8 @@
             "$ref": "#/components/schemas/schemaapp_securityMultiFieldAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Date SubAggregation\" Aggregate security events based on one of the sub aggregation types.",
+        "x-f5xc-description-medium": "X-displayName: \"Date SubAggregation\" Aggregate security events based on one of the sub aggregation types.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityDateSubAggregation",
           "required_fields": [
@@ -10133,6 +10707,8 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nThis option provides sub-aggregation for each field aggregation bucket.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each field aggregation bucket.",
+            "x-f5xc-description-medium": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each field aggregation bucket.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -10146,6 +10722,7 @@
             "title": "Topk",
             "format": "int64",
             "x-f5xc-example": "10",
+            "x-f5xc-description-short": "X-displayName: \"TopK\" Number of top field values to be returned in the response.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -10156,6 +10733,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field Aggregation\" Aggregate security events based on the key fields in the security event.",
+        "x-f5xc-description-medium": "X-displayName: \"Field Aggregation\" Aggregate security events based on the key fields in the security event.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityFieldAggregation",
           "required_fields": [
@@ -10180,6 +10759,8 @@
             "$ref": "#/components/schemas/schemaapp_securityCardinalityAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Field SubAggregation\" Aggregate security events in each field bucket based on one of the sub aggregation types.",
+        "x-f5xc-description-medium": "X-displayName: \"Field SubAggregation\" Aggregate security events in each field bucket based on one of the sub aggregation types.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityFieldSubAggregation",
           "required_fields": [
@@ -10260,6 +10841,8 @@
           "MALWARE_RECOMMENDED_ACTION"
         ],
         "default": "CITY",
+        "x-f5xc-description-short": "X-displayName: \"Key Field\" Security events can be aggregated based on these fields. - CITY: x-displayName: \"City\" - COUNTRY: x-displayName...",
+        "x-f5xc-description-medium": "X-displayName: \"Key Field\" Security events can be aggregated based on these fields. - CITY: x-displayName: \"City\" - COUNTRY: x-displayName: \"Country\" - SEC_EVENT_TYPE: x-displayName: \"Security Event Type\" - SRC_SITE: x-displayName: \"Source Site\" - VH_NAME: x-displayName: \"Virtual Host Name\" ...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityKeyField",
           "required_fields": [],
@@ -10278,6 +10861,8 @@
           "SUSPICION_SCORE"
         ],
         "default": "SUSPICION_SCORE",
+        "x-f5xc-description-short": "X-displayName: \"Metric Field\" Metrics can be computed based on these fields. - SUSPICION_SCORE: x-displayName: \"Suspicion Score\".",
+        "x-f5xc-description-medium": "X-displayName: \"Metric Field\" Metrics can be computed based on these fields. - SUSPICION_SCORE: x-displayName: \"Suspicion Score\".",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityMetricField",
           "required_fields": [],
@@ -10297,6 +10882,8 @@
             "$ref": "#/components/schemas/schemaapp_securityPercentileAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Metrics Aggregation\" Computes metrics based on values for the field in the security event.",
+        "x-f5xc-description-medium": "X-displayName: \"Metrics Aggregation\" Computes metrics based on values for the field in the security event.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityMetricsAggregation",
           "required_fields": [
@@ -10324,6 +10911,8 @@
             "type": "object",
             "description": "X-displayName: \"Sub Aggregation\"\nThis option provides sub-aggregation for each field aggregation bucket.",
             "title": "Sub aggregation.",
+            "x-f5xc-description-short": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each field aggregation bucket.",
+            "x-f5xc-description-medium": "X-displayName: \"Sub Aggregation\" This option provides sub-aggregation for each field aggregation bucket.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -10337,6 +10926,7 @@
             "title": "Topk",
             "format": "int64",
             "x-f5xc-example": "10",
+            "x-f5xc-description-short": "X-displayName: \"TopK\" Number of top field values to be returned in the response.",
             "minimum": 0,
             "maximum": 2147483647,
             "x-f5xc-required-for": {
@@ -10347,6 +10937,8 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Multi-Field Aggregation\" Aggregate security events based on the multiple fields in the security event.",
+        "x-f5xc-description-medium": "X-displayName: \"Multi-Field Aggregation\" Aggregate security events based on the multiple fields in the security event.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityMultiFieldAggregation",
           "required_fields": [
@@ -10371,6 +10963,8 @@
             "$ref": "#/components/schemas/schemaapp_securityCardinalityAggregation"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Multi Field SubAggregation\" Aggregate security events in each MultiTerms bucket based on one of the sub aggregation types.",
+        "x-f5xc-description-medium": "X-displayName: \"Multi Field SubAggregation\" Aggregate security events in each MultiTerms bucket based on one of the sub aggregation types.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityMultiFieldSubAggregation",
           "required_fields": [
@@ -10404,6 +10998,8 @@
           "JA4_TLS_FINGERPRINT_COUNTRY"
         ],
         "default": "ASN_COUNTRY",
+        "x-f5xc-description-short": "X-displayName: \"Multi-Key Field\" Security events can be aggregated based on these multiple key fields - ASN_COUNTRY: x-displayName: \"ASN, Country\"...",
+        "x-f5xc-description-medium": "X-displayName: \"Multi-Key Field\" Security events can be aggregated based on these multiple key fields - ASN_COUNTRY: x-displayName: \"ASN, Country\" Aggregated by (keyfield.asn, keyfield.country) - DOMAIN_METHOD_API_EP: x-displayName: \"Domain, Method, API Endpoint\" Aggregated by (keyfield.domain...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityMultiKeyField",
           "required_fields": [],
@@ -10428,6 +11024,7 @@
             "title": "Percent",
             "format": "double",
             "x-f5xc-example": "[99.0]",
+            "x-f5xc-description-short": "X-displayName: \"Percent\" x-required Percentile for which value is calculated.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -10436,6 +11033,7 @@
             }
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Percentile Aggregation\" Calculates percentile over numeric values for a field.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaapp_securityPercentileAggregation",
           "required_fields": [
@@ -10499,6 +11097,7 @@
               "ves.io.schema.rules.string.http_header_field": "true",
               "ves.io.schema.rules.string.max_bytes": "256"
             },
+            "x-f5xc-description-short": "Case-insensitive HTTP header name. Required: YES.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -10508,9 +11107,11 @@
             },
             "x-original-maxLength": 256,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909605+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793730+00:00"
           }
         },
+        "x-f5xc-description-short": "Header matcher specifies the name of a single HTTP header and the criteria for the input request to match it.",
+        "x-f5xc-description-medium": "Header matcher specifies the name of a single HTTP header and the criteria for the input request to match it. The input has a list of actual values for each header name in the original HTTP request. A header matcher can check for one of the following: * Presence or absence of the header in the...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemapolicyHeaderMatcherType",
           "required_fields": [
@@ -10554,6 +11155,9 @@
               "ves.io.schema.rules.repeated.max_items": "32",
               "ves.io.schema.rules.repeated.unique": "true"
             },
+            "x-f5xc-example": "{\"key\": \"value\"}",
+            "x-f5xc-description-short": "The IP threat categories is obtained from the list and is used to auto-generate equivalent label selection expressions Required: YES.",
+            "x-f5xc-description-medium": "The IP threat categories is obtained from the list and is used to auto-generate equivalent label selection expressions Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -10622,6 +11226,7 @@
               "ves.io.schema.rules.message.required": "true",
               "ves.io.schema.rules.string.max_bytes": "256"
             },
+            "x-f5xc-description-short": "Case-sensitive HTTP query parameter name. Required: YES.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -10631,9 +11236,11 @@
             },
             "x-original-maxLength": 256,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909617+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793742+00:00"
           }
         },
+        "x-f5xc-description-short": "Query parameter matcher specifies the name of a single query parameter and the criteria for the input request to match it.",
+        "x-f5xc-description-medium": "Query parameter matcher specifies the name of a single query parameter and the criteria for the input request to match it. The input has a list of actual values for each query parameter name in the original HTTP request. A query parameter matcher can check for one of the following: * Presence or...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemapolicyQueryParameterMatcherType",
           "required_fields": [
@@ -10677,6 +11284,8 @@
               "ves.io.schema.rules.string.max_bytes": "128",
               "ves.io.schema.rules.string.min_bytes": "1"
             },
+            "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g.",
+            "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. Route's) name. Required: YES.",
             "x-f5xc-required-for": {
               "minimum_config": false,
               "create": false,
@@ -10685,7 +11294,7 @@
             },
             "x-original-maxLength": 128,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909622+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793748+00:00"
           },
           "namespace": {
             "type": "string",
@@ -10701,6 +11310,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.max_bytes": "64"
             },
+            "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g.",
+            "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. Route's) namespace.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -10710,7 +11321,7 @@
             },
             "x-original-maxLength": 64,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909626+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793752+00:00"
           },
           "tenant": {
             "type": "string",
@@ -10726,6 +11337,8 @@
             "x-validation-rules": {
               "ves.io.schema.rules.string.max_bytes": "64"
             },
+            "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g.",
+            "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. Route's) tenant.",
             "minLength": 0,
             "x-f5xc-required-for": {
               "minimum_config": false,
@@ -10737,9 +11350,11 @@
             "x-field-mutability": "read-only",
             "x-original-maxLength": 64,
             "x-reconciled-from-discovery": true,
-            "x-reconciled-at": "2026-01-05T14:37:41.909631+00:00"
+            "x-reconciled-at": "2026-01-07T15:27:53.793756+00:00"
           }
         },
+        "x-f5xc-description-short": "Type establishes a direct reference from one object(the referrer) to another(the referred).",
+        "x-f5xc-description-medium": "Type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for schemaviewsObjectRefType",
           "required_fields": [
@@ -10763,6 +11378,8 @@
             "$ref": "#/components/schemas/suspicious_user_logNumKeyField"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Avg aggregation\" GET the average value of the numeric values extracted from the field in the suspicious user log.",
+        "x-f5xc-description-medium": "X-displayName: \"Avg aggregation\" GET the average value of the numeric values extracted from the field in the suspicious user log.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for suspicious_user_logAvgAggregation",
           "required_fields": [
@@ -10784,6 +11401,8 @@
             "$ref": "#/components/schemas/suspicious_user_logNumKeyField"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Max aggregation\" GET the maximum value among the numeric values extracted from the field in the suspicious user log.",
+        "x-f5xc-description-medium": "X-displayName: \"Max aggregation\" GET the maximum value among the numeric values extracted from the field in the suspicious user log.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for suspicious_user_logMaxAggregation",
           "required_fields": [
@@ -10805,6 +11424,8 @@
             "$ref": "#/components/schemas/suspicious_user_logNumKeyField"
           }
         },
+        "x-f5xc-description-short": "X-displayName: \"Min aggregation\" GET the minimum value among the numeric values extracted from the field in the suspicious user log.",
+        "x-f5xc-description-medium": "X-displayName: \"Min aggregation\" GET the minimum value among the numeric values extracted from the field in the suspicious user log.",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for suspicious_user_logMinAggregation",
           "required_fields": [
@@ -10839,6 +11460,8 @@
           "WAF_SUSPICION_SCORE"
         ],
         "default": "SUSPICION_SCORE",
+        "x-f5xc-description-short": "X-displayName: \"Num-Key Field\" suspicious user log can be aggregated based on these numeric fields. - SUSPICION_SCORE: x-displayName: \"SUSPICION...",
+        "x-f5xc-description-medium": "X-displayName: \"Num-Key Field\" suspicious user log can be aggregated based on these numeric fields. - SUSPICION_SCORE: x-displayName: \"SUSPICION SCORE\" - BEHAVIOR_ANOMALY_SCORE: x-displayName: \"BEHAVIOR ANOMALY SCORE\" - BOT_DEFENSE_SEC_EVENT_COUNT: x-displayName: \"BOT DEFENSE SEC EVENT COUNT\" ...",
         "x-f5xc-minimum-configuration": {
           "description": "Minimum configuration for suspicious_user_logNumKeyField",
           "required_fields": [],