Skip to main content

​
Add case tag

Action ID: tools.google_chronicle.add_case_tag Adds a tag to a Case. Use tags to categorize cases for easier searching and reporting. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/addTag

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case to add Tag for.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The tag to add on the case.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Assign case

Action ID: tools.google_chronicle.assign_case Assigns a Case to an analyst or SOC role. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/patch

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
This can be a user or a @SocRole; the default value is the default soc-role defined in Settings.
​
string
required
The ID of the Case to update.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Bulk add case tag

Action ID: tools.google_chronicle.bulk_add_case_tag Adds a tag to multiple cases in a single operation. This helps in categorizing large sets of related cases efficiently. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkAddTag

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
array[integer]
required
Cases to add tags to.
​
string
required
The instance to execute bulk add tag on. Format: projects/{project}/locations/{location}/instances/{instance}
​
array[string]
required
The tags to add.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Bulk assign cases

Action ID: tools.google_chronicle.bulk_assign_cases Assigns multiple cases to a specific analyst or SOC role in bulk. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkAssign

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
array[integer]
required
Cases to assign.
​
string
required
The instance to execute bulk assign case on. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The user name of the new assignee.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Bulk change case priority

Action ID: tools.google_chronicle.bulk_change_case_priority Changes the priority level for multiple cases in bulk. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkChangePriority

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
array[integer]
required
Cases to change priority for.
​
string
required
The instance to execute bulk change priority on. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The priority to change the cases to. For example, “Informative”, “Low”, “Medium”, “High”, “Critical”.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Bulk change case stage

Action ID: tools.google_chronicle.bulk_change_case_stage Updates the case stage for multiple cases in bulk. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkChangeStage

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
array[integer]
required
Cases to change stage for.
​
string
required
The instance to execute bulk change stage on. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The case stage to change.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Bulk close cases

Action ID: tools.google_chronicle.bulk_close_cases Closes multiple cases in a single operation. A valid closure reason and root cause must be provided for all affected cases. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkClose

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
array[integer]
required
Cases to close.
​
string
required
Close reason. One of CLOSE_REASON_UNSPECIFIED, MALICIOUS, NOT_MALICIOUS, MAINTENANCE, INCONCLUSIVE, UNKNOWN.
​
string
required
The instance to execute bulk close on. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Comment to add to the cases when closing them.Default: null.
​
array[object] | null
Dynamic parameters added to the close case action. Each entry carries id (integer) and values (list of strings).Default: null.
​
string | null
Root cause of closing the cases.Default: null.

​
Bulk reopen cases

Action ID: tools.google_chronicle.bulk_reopen_cases Reopens multiple previously closed cases in a single operation. A comment explaining the reason for reopening is required. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkReopen

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
array[integer]
required
Cases to reopen.
​
string
required
The instance to execute bulk reopen on. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
Comment to add to the cases when reopening them.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Call API

Action ID: tools.google_chronicle.call_api Call a Chronicle REST API endpoint and return its response body. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
HTTP method for the Chronicle REST API request.
​
string
required
Full Google Chronicle REST API URL, including the API version and resource path.
​
object | null
Query parameters for the Chronicle API method.Default: null.
​
object | null
JSON request body for the Chronicle API method.Default: null.
​
number | null
Request timeout in seconds. Set to null to disable it.Default: 60.0.

​
Cancel operation

Action ID: tools.google_chronicle.cancel_operation Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. On successful cancellation the operation is not deleted; it becomes an operation with an error value whose code is CANCELLED. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.operations/cancel

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The ID of the operation resource to be cancelled.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Change case alert priority

Action ID: tools.google_chronicle.change_case_alert_priority Updates the priority of a CaseAlert. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/patch

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case the alert belongs to.
​
string
required
The ID of the CaseAlert to update.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The alert priority. One of LEGACY_CASE_PRIORITY_UNSPECIFIED, UNCHANGED, INFORMATIVE, LOW, MEDIUM, HIGH, CRITICAL. The default value is HIGH.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Change case priority

Action ID: tools.google_chronicle.change_case_priority Updates the priority of a Case. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/patch

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case to update.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
Case priority. For example, “Informative”, “Low”, “Medium”, “High”, “Critical”. The default value is HIGH.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Change case stage

Action ID: tools.google_chronicle.change_case_stage Updates the stage of a Case. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/patch

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case to update.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The stage of the Case. For example, “Triage”, “Incident”, “Investigation”. Stages are defined in “chronicle.googleapis.com/CaseStageDefinition”. The default stage option is “Triage”.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Close case alert

Action ID: tools.google_chronicle.close_case_alert Closes a CaseAlert. The vendor requires a valid closure reason and comment when closing an alert. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/patch

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case the alert belongs to.
​
string
required
The ID of the CaseAlert to close.
​
string
required
Alert closure comment.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
Alert closure reason. One of CLOSE_REASON_UNSPECIFIED, MALICIOUS, NOT_MALICIOUS, MAINTENANCE, INCONCLUSIVE, UNKNOWN.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Alert closure root cause.Default: null.

​
Create case comment

Action ID: tools.google_chronicle.create_case_comment Creates a new CaseComment. Use this method to add investigative notes or collaborate with other analysts. Comments can optionally include base64 encoded attachments. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/create

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case this CaseComment will be created on.
​
string
required
The content of the comment.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
The alert associated with the comment.Default: null.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
object | null
The attachment associated with the comment. Required fields when present: attachmentBase64 (base64 encoded attachment), fileType, fileName.Default: null.
​
boolean | null
Whether the comment is marked as a favorite.Default: null.

​
Create retrohunt

Action ID: tools.google_chronicle.create_retrohunt Creates a Retrohunt, an execution of a Rule over a time range in the past. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.retrohunts/create

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Exclusive end of the event time range this retrohunt processes, in RFC 3339 format.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule the retrohunt belongs to, optionally suffixed with @{revisionId}. A retrohunt is the child of a rule revision.
​
string
required
Inclusive start of the event time range this retrohunt processes, in RFC 3339 format, e.g. “2014-10-02T15:01:23Z”.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Create rule

Action ID: tools.google_chronicle.create_rule Creates a new Rule. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/create

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The parent resource where this rule will be created. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The YARA-L content of the rule.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Resource name of the DataAccessScope bound to this rule. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user’s and the rule’s scopes. Format: projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}Default: null.

​
Delete case comment

Action ID: tools.google_chronicle.delete_case_comment Performs a soft delete of a CaseComment, removing the comment’s content from general view while preserving its metadata for audit purposes. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/delete

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case the comment belongs to.
​
string
required
The ID of the CaseComment to delete.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Delete rule

Action ID: tools.google_chronicle.delete_rule Deletes a Rule. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/delete

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule ID of the rule to delete. A rule revision timestamp cannot be specified as part of the name, as deleting specific revisions is not supported.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
boolean | null
If set to true, any retrohunts and any detections associated with the rule will also be deleted. If set to false, the call will only succeed if the rule has no associated retrohunts, including completed retrohunts, and no associated detections. Regardless of this field’s value, the rule deployment associated with this rule will also be deleted.Default: null.

​
Disable rule

Action ID: tools.google_chronicle.disable_rule Stops a rule from running against incoming data by clearing enabled on its RuleDeployment. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/updateDeployment

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule ID whose deployment to disable. RuleDeployment is a child of the overall Rule, not any individual revision, so this must not reference a specific revision.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Enable rule

Action ID: tools.google_chronicle.enable_rule Deploys a rule continuously against incoming data by setting enabled on its RuleDeployment. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/updateDeployment

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule ID whose deployment to enable. RuleDeployment is a child of the overall Rule, not any individual revision, so this must not reference a specific revision.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Execute query

Action ID: tools.google_chronicle.execute_query Performs a UDM search that returns matching events, or statistics rows, for the query. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/udmSearch

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Exclusive end of the time range to search, as an RFC 3339 timestamp.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The UDM query to run, including event, statistics, or SQL queries.
​
string
required
Inclusive start of the time range to search, as an RFC 3339 timestamp, e.g. “2014-10-02T15:01:23Z”.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
integer
Maximum number of results to return. Chronicle coerces values over 10000 to 10000.Default: 100.
​
string
Language of the query string. Chronicle supports YL2 and SQL.Default: "YL2".
​
number | null
Request timeout in seconds. Set to null to disable it.Default: 60.0.

​
Find entity

Action ID: tools.google_chronicle.find_entity Identifies the entity type and retrieves relevant data associated with a specified indicator. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findEntity

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Namespace of the entity being queried.
​
string
required
Entity indicator to search for.
​
string
required
The ID of the Instance to find entity for. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
Reference time to lookup entity, in RFC 3339 format, e.g. “2014-10-02T15:01:23Z”.
​
string
required
The UDM field the entity indicator belongs to.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Find entity alerts

Action ID: tools.google_chronicle.find_entity_alerts Gets alerts for an entity. The API returns a maximum of 1000 alerts for the requested entity. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findEntityAlerts

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Exclusive end of the time range to retrieve the alerts for, in RFC 3339 format.
​
string
required
The ID of the Instance to summarize entity for. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
Inclusive start of the time range to retrieve the alerts for, in RFC 3339 format, e.g. “2014-10-02T15:01:23Z”.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
ID of the entity. Use this or the field_and_value_* inputs to identify the entity.Default: null.
​
string | null
Entity namespace, applicable to asset entities.Default: null.
​
string | null
UDM field path identifying the indicator type.Default: null.
​
string | null
Indicator value used to identify the entity.Default: null.
​
string | null
Chronicle value type identifying the indicator type.Default: null.
Action ID: tools.google_chronicle.find_related_entities Finds all the entities associated with provided entity. The API returns a maximum of 100 entities. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findRelatedEntities

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Exclusive end of the time range to search related entities for, in RFC 3339 format.
​
string
required
The name of the parent resource, which is the SecOps instance to find related entities for. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
Inclusive start of the time range to search related entities for, in RFC 3339 format, e.g. “2014-10-02T15:01:23Z”.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
The domain type to retrieve. This is taken into account when the entity type is specified as “DOMAIN_NAME”.Default: null.
​
string | null
ID of the entity. Use this or the field_and_value_* inputs to identify the entity.Default: null.
​
array[string] | null
Entity types to filter related entities by. If unspecified, will return all related entities for the given entity.Default: null.
​
boolean | null
If true, then the related entities will not have first/last seen info and reduce latency of endpoint.Default: null.
​
string | null
Entity namespace, applicable to asset entities.Default: null.
​
string | null
UDM field path identifying the indicator type.Default: null.
​
string | null
Indicator value used to identify the entity.Default: null.
​
string | null
Chronicle value type identifying the indicator type.Default: null.
​
boolean | null
If true, it includes all types of events we show in UDM Search to calculate the first and last seen time of an entity.Default: null.
​
integer | null
The maximum number of Entities to return. The service may return fewer than this value. If unspecified, at most 100 entities will be returned. The maximum value is 100; values above 100 will be coerced to 100.Default: null.

​
Find UDM field values

Action ID: tools.google_chronicle.find_udm_field_values Finds ingested UDM field values that match a query. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findUdmFieldValues

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The partial UDM field value to match.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
integer | null
The maximum number of value matches to return. The service may return fewer matches than this value. If unspecified, defaults to 250. The maximum value is 1000; values above 1000 will be coerced to 1000.Default: null.

​
Get alert

Action ID: tools.google_chronicle.get_alert RPC for fetching an alert based on its Alert Id. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetAlert

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the collection to return.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
boolean | null
If set to true, response will include non-alerting detections.Default: null.

​
Get case

Action ID: tools.google_chronicle.get_case Gets a single Case by its resource name, including its alerts, entities, and investigation history. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/get

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case to retrieve.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Expand field for getting related resources.Default: null.

​
Get case alert

Action ID: tools.google_chronicle.get_case_alert Gets a single CaseAlert, including its current status, priority, and associated metadata. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/get

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case the alert belongs to.
​
string
required
The ID of the CaseAlert to retrieve.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Expand the response to include the full alert object. Supported values: sla, involvedRelations. Example: “sla, involvedRelations”Default: null.

​
Get case comment

Action ID: tools.google_chronicle.get_case_comment Gets a single CaseComment by its resource name, returning the content and metadata of a specific comment. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/get

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case the comment belongs to.
​
string
required
The ID of the CaseComment to retrieve.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Expand field for getting related resources.Default: null.

​
Get detection

Action ID: tools.google_chronicle.get_detection Legacy endpoint for fetching a Detection. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetDetection

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The detection to get.
​
string
required
The name of the parent resource, which is the SecOps instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The specific rule revision to get a detection for. There are two acceptable formats: “{ruleId}” gets a detection for the latest revision of the Rule, and “{ruleId}@{revisionId}” gets a detection for that revision.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Get event for detection

Action ID: tools.google_chronicle.get_event_for_detection Legacy endpoint for getting event for curated detection. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetEventForDetection

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The unique ID of the curated detection, as a base64-encoded string.
​
string
required
The name of the parent resource, which is the SecOps instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Last row ID from the previous response page token.Default: null.
​
string | null
Last row timestamp from the previous response page token.Default: null.
​
integer | null
Offset from the previous response page token.Default: null.
​
integer | null
Number of events to return per page. Default value is 1000 if the pageSize is not set in the request.Default: null.

​
Get operation

Action ID: tools.google_chronicle.get_operation Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.operations/get

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The ID of the operation resource.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Get retrohunt

Action ID: tools.google_chronicle.get_retrohunt Gets a Retrohunt. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.retrohunts/get

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The ID of the retrohunt to retrieve.
​
string
required
The rule the retrohunt belongs to, optionally suffixed with @{revisionId}.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Get rule

Action ID: tools.google_chronicle.get_rule Gets a Rule. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/get

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule ID of the rule to retrieve, optionally suffixed with @{revisionId} to pin a revision.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
The scope of fields to populate for the Rule being returned. If unspecified, defaults to FULL. One of BASIC, FULL, REVISION_METADATA_ONLY.Default: null.

​
Get rule deployment

Action ID: tools.google_chronicle.get_rule_deployment Gets a RuleDeployment. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/getDeployment

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule ID whose deployment to retrieve. RuleDeployment is a child of the overall Rule, not any individual revision, so this must not reference a specific revision.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
List case alerts

Action ID: tools.google_chronicle.list_case_alerts Lists CaseAlerts within a specific Case. Supports filtering by status, priority, and other alert attributes. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/list

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case to list CaseAlerts for.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Fields to distinct results. Example: caseIdDefault: null.
​
string | null
Expand the response to include the full alert object. Supported values: sla, involvedRelations. Example: “sla, involvedRelations”Default: null.
​
string | null
A filter to apply to the list of CaseAlerts. Supported filter fields: displayName, caseId, identifier, sourceGroupingIdentifier, product, vendor, environment, ticketId, sourceSystemName, creation_method, priority, status, startTime, endTime, additionalProperties, involvedRelations. Example: filter=“displayName=‘some_name’”Default: null.
​
string | null
Configures ordering of CaseAlerts in the response. If not specified, CaseAlerts are returned in descending order of their create time. The orderBy string is a comma separated list of fields. Example: “displayName desc, default”Default: null.
​
integer | null
The maximum number of CaseAlerts to return. The service may return fewer than this value. If unspecified, at most 50 CaseAlerts will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.Default: null.
​
string | null
A page token, received from a previous caseAlerts.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to caseAlerts.list must match the call that provided the page token.Default: null.

​
List case comments

Action ID: tools.google_chronicle.list_case_comments Lists CaseComments associated with a specific Case. Supports filtering by author, creation time and other fields. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/list

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case to list CaseComments for.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Expand the response to include the full comment object. Supported values: caseAttachmentDefault: null.
​
string | null
A filter to apply to the list of CaseComments. Supported filter fields: createTime, updateTime, user, comment, deletionInvoker, favorite, alert, deleted. Example: filter=“comment=‘some_comment’”Default: null.
​
string | null
Configures ordering of CaseComments in the response. If not specified, CaseComments are returned in descending order of their create time. Supported sort fields: createTime, updateTime, user, comment, deletionInvoker, favorite, alert, deleted. For example: “comment desc, favorite”Default: null.
​
integer | null
The maximum number of CaseComments to return. The service may return fewer than this value. If unspecified, at most 50 CaseComments will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.Default: null.
​
string | null
A page token, received from a previous caseComments.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters must match the call that provided the page token.Default: null.

​
List cases

Action ID: tools.google_chronicle.list_cases Lists Cases in an instance. Supports extensive filtering and ordering based on case attributes like priority, status, assignee and more. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/list

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The instance to list Cases for. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
The field to distinct the cases by.Default: null.
​
string | null
Expand the response to include the full case object. Supported values: tasks, tags, products. Example: “tags, products”Default: null.
​
string | null
A filter to apply to the list of Cases. Supported filter fields: displayName, creatorUserId, creatorUser, lastModifyingUserId, lastModifyingUser, assignee, assignedUser, stage, priority, important, type, environment, case_data_state, score, alertsSla, sla, tags, products, closureDetails, tasks. Example: filter=“displayName=‘some_name’”Default: null.
​
string | null
Configures ordering of Cases in the response. If not specified, Cases are returned in descending order of their create time. The orderBy string is a comma separated list of fields. Example: “displayName desc, priority”Default: null.
​
integer | null
The maximum number of cases to return. The service may return fewer than this value. If unspecified, at most 50 Cases will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.Default: null.
​
string | null
A page token, received from a previous cases.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to cases.list must match the call that provided the page token.Default: null.

​
List detections

Action ID: tools.google_chronicle.list_detections Legacy endpoint for searching detections for a rule version. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacySearchDetections

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The specific rule revision to search detections for. There are four acceptable formats: “{ruleId}” retrieves detections for the latest revision of the Rule; “{ruleId}@{revisionId}” retrieves detections for that revision; “{ruleId}@-” retrieves detections for all revisions of the Rule; ”-” retrieves detections for all revisions of all Rules.
​
string | null
An enum that filters which detections are returned by their AlertState. One of UNSPECIFIED, NOT_ALERTING, ALERTING.Default: null.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
The time to end searching detections to, exclusive, in RFC 3339 format.Default: null.
​
boolean | null
If true, include one level of nested detections in the response.Default: null.
​
boolean | null
Deprecated. If true, include simulated detections in the response. Prefer simulatedDataVisibility for new workflows.Default: null.
​
string | null
Basis for determining whether to apply startTime and endTime filters for detection time or creation time of the detection. One of LIST_BASIS_UNSPECIFIED, DETECTION_TIME, CREATED_TIME.Default: null.
​
integer | null
The maximum size of response in bytes. If it is set to 0 (or is omitted), the server will not enforce any max response size limit.Default: null.
​
integer | null
Maximum number of detections to return.Default: null.
​
string | null
A page token, received from a previous legacy.legacySearchDetections call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to legacy.legacySearchDetections must match the call that provided the page token.Default: null.
​
string | null
Specifies visibility of simulated data to include in search results.Default: null.
​
string | null
The time to start search detections from, inclusive, in RFC 3339 format, e.g. “2014-10-02T15:01:23Z”.Default: null.

​
List operations

Action ID: tools.google_chronicle.list_operations Lists operations that match the specified filter in the request. If the server doesn’t support this method, it returns UNIMPLEMENTED. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.operations/list

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The name of the operation’s parent resource. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
The standard list filter.Default: null.
​
integer | null
The standard list page size.Default: null.
​
string | null
The standard list page token.Default: null.
​
boolean | null
Return reachable operations normally and report unreachable collections in the response. Chronicle may return UNIMPLEMENTED when this option is unsupported.Default: null.

​
List retrohunts

Action ID: tools.google_chronicle.list_retrohunts Lists Retrohunts. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.retrohunts/list

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule that the retrohunts belong to. Use ”-” to list retrohunts across all rules.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
A filter that can be used to retrieve specific retrohunts. The following fields are filterable: stateDefault: null.
​
integer | null
The maximum number of retrohunt to return. The service may return fewer than this value. If unspecified, at most 100 retrohunts will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.Default: null.
​
string | null
A page token, received from a previous retrohunts.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to retrohunts.list must match the call that provided the page token.Default: null.

​
List rule deployments

Action ID: tools.google_chronicle.list_rule_deployments Lists RuleDeployments across all Rules. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.deployments/list

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}. The ”-” wildcard token is used as the rule identifier so deployments across all rules are returned.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
A filter that can be used to retrieve specific rule deployments. The following fields are filterable: archived, nameDefault: null.
​
integer | null
The maximum number of rule deployments to return. The service may return fewer than this value. If unspecified, at most 100 rule deployments will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.Default: null.
​
string | null
A page token, received from a previous deployments.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to deployments.list must match the call that provided the page token.Default: null.

​
List rule execution errors

Action ID: tools.google_chronicle.list_rule_execution_errors Lists rule execution errors. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.ruleExecutionErrors/list

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The instance to list rule execution errors from. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
A filter that can be used to retrieve specific rule execution errors. Only the following filters are allowed: rule = “{Rule.name}”, curatedRule = “{CuratedRule.name}”. For ‘rule’ an optional revision id may be appended as “{Rule.name}@{Rule.revision_id}”, or “{Rule.name}@-” to fetch errors across all revisions. Revision IDs are not supported for curated rules.Default: null.
​
integer | null
The maximum number of rule execution errors to return. The service may return fewer than this value. If unspecified, at most 1000 rule execution errors will be returned. The maximum value is 10000; values above 10000 will be coerced to 10000.Default: null.
​
string | null
A page token, received from a previous ruleExecutionErrors.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to ruleExecutionErrors.list must match the call that provided the page token.Default: null.

​
List rule revisions

Action ID: tools.google_chronicle.list_rule_revisions Lists all revisions of a rule. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/listRevisions

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule ID of the rule to list revisions for.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
integer | null
The maximum number of revisions to return per page. The service may return fewer than this value. If unspecified, at most 100 revisions will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.Default: null.
​
string | null
The page token, received from a previous rules.listRevisions call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to rules.listRevisions must match the call that provided the page token.Default: null.
​
string | null
The scope of fields to populate for the revision being returned. If unspecified, defaults to BASIC. One of BASIC, FULL, REVISION_METADATA_ONLY.Default: null.

​
List rules

Action ID: tools.google_chronicle.list_rules Lists Rules. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/list

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The parent, which owns this collection of rules. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Only the following filters are allowed: “referenceLists:{reference_list_name}” “dataTables:{dataTableName}” “displayName:{displayName}”Default: null.
​
string | null
The sort order of the rules. If unspecified, rules will be sorted by revisionCreateTime desc ruleId asc. Sorting is supported on a single field only. Supported fields: “archived”, “alertingEnabled”, “author”, “createTime”, “currentDayDetectionCount”, “displayName”, “executionState”, “liveModeEnabled”, “revisionCreateTime”, “ruleId”, “ruleOwner”, “severity”, “type”. Example: “displayName desc”Default: null.
​
integer | null
The maximum number of rules to return. The service may return fewer than this value. If unspecified, at most 100 rules will be returned. The maximum value is 1000, or 5000 if view is set to CONFIG_ONLY; values above the applicable maximum will be coerced to that maximum.Default: null.
​
string | null
A page token, received from a previous rules.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to rules.list must match the call that provided the page token.Default: null.
​
integer | null
The number of rules to skip in the response. Skipping is only supported in TRENDS view.Default: null.
​
string | null
The scope of fields to populate for the Rule being returned. If unspecified, defaults to BASIC. One of BASIC, FULL, REVISION_METADATA_ONLY, CONFIG_ONLY, TRENDS.Default: null.

​
Reopen case alert

Action ID: tools.google_chronicle.reopen_case_alert Reopens a closed CaseAlert by setting its status back to OPEN. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/patch

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case the alert belongs to.
​
string
required
The ID of the CaseAlert to reopen.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.

​
Search alerts

Action ID: tools.google_chronicle.search_alerts Legacy endpoint for getting alerts (and in some cases, non-alerting detections) along with aggregated fields that match the query. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyFetchAlertsView

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Exclusive end of the time range to search, in RFC 3339 format.
​
string
required
The name of the parent resource, which is the SecOps instance. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
This uses a syntax similar to UDM search, with support for all fields within 7 levels of nesting within the collection proto. For composite detections, the filters prefixed with “collectionElements.references.event” or “collectionElements.references.entity” are also checked against one-level of producer detections.
​
string
required
Inclusive start of the time range to search, in RFC 3339 format, e.g. “2014-10-02T15:01:23Z”.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
The baseline query is used for this request and its results are cached for subsequent requests, so that supplying additional filters in the snapshotQuery will not require re-running the baseline query. This uses a syntax similar to UDM search, and all fields are supported except for the path prefix feedbackSummary.*.Default: null.
​
string | null
If enabled, subsequent requests for the same time range and baseline query will try to leverage our cache to serve the response with filters applied in the snapshot query. One of ALERTS_FEATURE_PREFERENCE_UNSPECIFIED, ALERTS_FEATURE_PREFERENCE_ENABLED, ALERTS_FEATURE_PREFERENCE_DISABLED.Default: null.
​
string | null
Asset IP address entity indicator. Set at most one indicator value.Default: null.
​
string | null
Destination IP entity indicator. Set at most one indicator value.Default: null.
​
string | null
Domain name entity indicator. Set at most one indicator value.Default: null.
​
string | null
Email entity indicator. Set at most one indicator value.Default: null.
​
string | null
Employee ID entity indicator. Set at most one indicator value.Default: null.
​
string | null
File path entity indicator. Set at most one indicator value.Default: null.
​
string | null
Full command line entity indicator. Set at most one indicator value.Default: null.
​
string | null
MD5 hash entity indicator. Set at most one indicator value.Default: null.
​
string | null
SHA-1 hash entity indicator. Set at most one indicator value.Default: null.
​
string | null
SHA-256 hash entity indicator. Set at most one indicator value.Default: null.
​
string | null
Hostname entity indicator. Set at most one indicator value.Default: null.
​
string | null
MAC address entity indicator. Set at most one indicator value.Default: null.
​
string | null
Namespace for an asset entity indicator.Default: null.
​
string | null
Parent process ID entity indicator. Set at most one indicator value.Default: null.
​
string | null
Process ID entity indicator. Set at most one indicator value.Default: null.
​
string | null
Product-specific asset ID indicator. Set at most one indicator value.Default: null.
​
string | null
Product object ID entity indicator. Set at most one indicator value.Default: null.
​
string | null
Raw process ID entity indicator. Set at most one indicator value.Default: null.
​
string | null
Resource name entity indicator. Set at most one indicator value.Default: null.
​
string | null
User name entity indicator. Set at most one indicator value.Default: null.
​
string | null
Windows SID entity indicator. Set at most one indicator value.Default: null.
​
string | null
Whether to include non-alerting detections in the response. One of ALERTS_FEATURE_PREFERENCE_UNSPECIFIED, ALERTS_FEATURE_PREFERENCE_ENABLED, ALERTS_FEATURE_PREFERENCE_DISABLED.Default: null.
​
string | null
The maximum size, in bytes, of the alerts data returned in the response, as an int64 string. If the total size of alerts exceeds this limit, the list of alerts is truncated and memoryLimitExceeded is set in the response. If unspecified or set to 0, no size limit is applied.Default: null.
​
integer | null
Parameter for the Alerts that will be streamed back; caps the number of matched alerts returned in alerts.Default: null.
​
integer | null
Parameter for the Aggregated Alert fields that will be streamed back; caps the number of values returned per aggregated field.Default: null.
​
string | null
Specifies visibility of simulated data to include in search results.Default: null.

​
Search cases

Action ID: tools.google_chronicle.search_cases Performs a search for security cases matching the provided criteria. Returns a list of investigations based on status, priority, environment, and associated metadata. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacySearches/legacyCaseSearchEverything

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The instance to get the search results for. Format: projects/{project}/locations/{location}/instances/{instance}
​
array[string] | null
A list of strings that represents the Users (analysts) / Roles that are assigned to the case. Available inputs: Username (GUID) / @Role name.Default: null.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
A string that represents a part of the body of a case comment to search for in cases.Default: null.
​
array[string] | null
List of strings representing case sources. Available inputs: System / Manual / Test.Default: null.
​
array[string] | null
List of strings that represents whether to fetch cases that contain a specific value in CategoryOutcome. Available inputs: Allowed / Blocked / [] (empty).Default: null.
​
string | null
Represents the reason the case was closed and fetches cases that match the value.Default: null.
​
boolean | null
A boolean field that represents whether the Localization (timezone) settings should be ignored. Applies to startTime and endTime. Available inputs: true / false / null.Default: null.
​
string | null
The UTC end time to search for cases by creation time, in RFC 3339 format. Used if timeRangeFilter is set to the custom filter. Defaults to current time.Default: null.
​
array[string] | null
List of strings representing the environments that the case is associated with. If the case matches at least one environment it will be fetched.Default: null.
​
string | null
Represents the ‘TicketId’ mapped from the original SIEM’s alert ID.Default: null.
​
array[string] | null
List of strings representing the case importance (i.e. marked as “is important”). Available inputs: True / False.Default: null.
​
array[string] | null
List of strings representing cases marked as incidents. Available inputs: True / False.Default: null.
​
string | null
A string that represents an entity to search for in cases.Default: null.
​
boolean | null
A boolean field that represents whether to filter by the case status (is closed or not). Available inputs: true / false / null.Default: null.
​
integer | null
Number of entries to return.Default: null.
​
object | null
Paging options for the search.Default: null.
​
array[string] | null
List of strings that represent the ports that exist in the case. If the case matches at least one Port it will be fetched.Default: null.
​
array[string] | null
List of strings representing case priority.Default: null.
​
array[string] | null
List of strings that represent the Products that exists in the case. If the case matches at least one Product it will be fetched.Default: null.
​
integer | null
The requested page.Default: null.
​
array[string] | null
List of strings that represents the Rule Generator (Alert Type in the Platform) that exist in the case.Default: null.
​
string | null
Search term.Default: null.
​
object | null
The sort by property and order.Default: null.
​
array[string] | null
List of strings that represents the Stages that case is on. Available inputs: Triage / Assessment / Investigation / Incident / Improvement / Research.Default: null.
​
string | null
The UTC start time to search for cases by creation time, in RFC 3339 format. Used if timeRangeFilter is set to the custom filter. Defaults to the start of epoch time.Default: null.
​
array[string] | null
List of strings representing case tags. If one or more tags exist in the case, it will be fetched.Default: null.
​
string | null
Represents the number of days back to search cases by creation time. For a custom time range use 0 and set the startTime and endTime parameters.Default: null.
​
string | null
A string that represents free text / search term to search for cases. Available inputs: free text / Entity: / AlertName: / DestinationEntity: / SourceEntity: / TicketIds: / CaseIDs:Default: null.

​
Search findings

Action ID: tools.google_chronicle.search_findings Legacy endpoint for listing Findings. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacySearchFindings

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Exclusive end of the times range to get the findings from, in RFC 3339 format.
​
array[string]
required
Finding type: Uppercase, DSML, etc.
​
string
required
The name of the parent resource, which is the SecOps instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
Inclusive start of the times range to get the findings from, in RFC 3339 format, e.g. “2014-10-02T15:01:23Z”.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Last row ID from the previous response page token.Default: null.
​
string | null
Last row timestamp from the previous response page token.Default: null.
​
integer | null
Offset from the previous response page token.Default: null.
​
integer | null
Number of findings to return per page. Default value is 1000 if the pageSize is not set in the request.Default: null.

​
Test rule

Action ID: tools.google_chronicle.test_rule Runs a rule text over a bounded historical time range without creating a rule. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyRunTestRule

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Exclusive end of the time range the rule should be tested on, in RFC 3339 format. The range is limited to 14 days.
​
string
required
The Chronicle instance associated with the request. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule text to be tested.
​
string
required
Inclusive start of the time range the rule should be tested on, in RFC 3339 format, e.g. “2014-10-02T15:01:23Z”.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
integer | null
The maximum number of results to return. The service may return fewer than this value. If unspecified, at most 1000 detections will be returned. The maximum value is 10000; values above 10000 will be coerced to 10000.Default: null.
​
string | null
The data access scope to use to run the rule. This field is only required if data access control is enabled. Format: projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}Default: null.

​
Update alert

Action ID: tools.google_chronicle.update_alert Legacy endpoint for updating an alert. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyUpdateAlert

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The id of the alert.
​
object
required
The analyst-supplied feedback on the alert. Writable fields: verdict, reputation, confidenceScore (0-100), riskScore (0-100), disregarded, severity (1-100), comment, status, priority, rootCause, reason, severityDisplay.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
The case name that the alert is associated with.Default: null.
​
object | null
The response platform info of the alert.Default: null.

​
Update case comment

Action ID: tools.google_chronicle.update_case_comment Updates an existing CaseComment. Use this method to correct or clarify previously added information. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/patch

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The ID of the Case the comment belongs to.
​
string
required
The ID of the CaseComment to update.
​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The list of fields to update. This is a comma-separated list of fully qualified names of fields, e.g. “comment”. If not included, all fields with default/non-default values will be overwritten.
​
string | null
The alert associated with the comment.Default: null.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
object | null
The attachment associated with the comment. Required fields when present: attachmentBase64 (base64 encoded attachment), fileType, fileName.Default: null.
​
string | null
The content of the comment.Default: null.
​
boolean | null
Whether the comment is marked as a favorite.Default: null.

​
Update rule

Action ID: tools.google_chronicle.update_rule Updates a Rule. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/patch

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule ID of the rule to update.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
string | null
Resource name of the DataAccessScope bound to this rule. Format: projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}Default: null.
​
string | null
The YARA-L content of the rule.Default: null.
​
string | null
The list of fields to update. If not included, all fields with a non-empty value will be overwritten. This is a comma-separated list of fully qualified names of fields, e.g. “text”.Default: null.

​
Update rule deployment

Action ID: tools.google_chronicle.update_rule_deployment Updates a RuleDeployment. Failures are not necessarily atomic. If there is a request to update multiple fields, and any update to a single field fails, an error will be returned, but other fields may remain successfully updated. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/updateDeployment

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule ID whose deployment to update. RuleDeployment is a child of the overall Rule, not any individual revision, so this must not reference a specific revision.
​
string
required
Required. The list of fields to update. This is a comma-separated list of fully qualified names of fields, e.g. “enabled,alerting”. Schedule customizations are tied to run frequency and must be updated with the “runFrequency” mask.
​
boolean | null
Whether detections resulting from this deployment should be considered alerts.Default: null.
​
boolean | null
The archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and runFrequency cannot be updated.Default: null.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.
​
boolean | null
Whether the rule is currently deployed continuously against incoming data.Default: null.
​
string | null
The run frequency of the rule deployment. One of LIVE, HOURLY, DAILY.Default: null.
​
object | null
The schedule customizations of the rule deployment. Only valid for customizable run frequencies. Documented fields: ensureEnrichmentCompleteness (boolean), lateArrivingDataAdjustment (duration string, e.g. “3.5s”).Default: null.

​
Verify rule text

Action ID: tools.google_chronicle.verify_rule_text Verifies a rule text without creating a rule. Reference: https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/verifyRuleText

​
Secrets

Optional secrets:
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_USER_TOKEN.
  • google_chronicle_oauth: OAuth token GOOGLE_CHRONICLE_SERVICE_TOKEN.

​
Input fields

​
string
required
The name of the parent resource, which is the SecOps instance associated with the request. Format: projects/{project}/locations/{location}/instances/{instance}
​
string
required
The rule text to verify as a UTF-8 string.
​
string | null
Chronicle API base URL. If omitted, uses the workspace variable google_chronicle.base_url, for example https://us-chronicle.googleapis.com.Default: null.