Quick question: in the incident-response pack, “last” query, what does the “type” field actually mean?