sorry got tied up with other stuff. what data point do you need from detections list that you have to join it to the details?
try one of the jsonatas below.
parse-json
| scope "resources"
#|jsonata "$.{'detection_id': detection_id, 'hostname': device.hostname, 'external_ip': device.external_ip, 'local_ip': device.local_ip}"
|jsonata " ( $data := $map($, function($v) { { 'detection_id': $v.detection_id, 'hostname': $v.device.hostname, 'external_ip': $v.device.external_ip, 'local_ip': $v.device.local_ip } });$data[detection_id='$detections'];)"
Or do you want the capability to filter by detection_id:
ldt:aad4340146db4f94b3efafaa5e6f7bf2:240518760420
or All?