> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Chronicle

> Reference for the Tracecat Google Chronicle integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Add case tag

Action ID: `tools.google_chronicle.add_case_tag`

Adds a tag to a Case. Use tags to categorize cases for easier searching and reporting.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/addTag](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/addTag)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case to add Tag for.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="tag" type="string" required>
  The tag to add on the case.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Assign case

Action ID: `tools.google_chronicle.assign_case`

Assigns a Case to an analyst or SOC role.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/patch](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/patch)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="assignee" type="string" required>
  This can be a user or a @SocRole; the default value is the default soc-role defined in Settings.
</ParamField>

<ParamField path="case" type="string" required>
  The ID of the Case to update.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Bulk add case tag

Action ID: `tools.google_chronicle.bulk_add_case_tag`

Adds a tag to multiple cases in a single operation. This helps in categorizing large sets of related cases efficiently.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkAddTag](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkAddTag)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="casesIds" type="array[integer]" required>
  Cases to add tags to.
</ParamField>

<ParamField path="instance" type="string" required>
  The instance to execute bulk add tag on. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="tags" type="array[string]" required>
  The tags to add.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Bulk assign cases

Action ID: `tools.google_chronicle.bulk_assign_cases`

Assigns multiple cases to a specific analyst or SOC role in bulk.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkAssign](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkAssign)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="casesIds" type="array[integer]" required>
  Cases to assign.
</ParamField>

<ParamField path="instance" type="string" required>
  The instance to execute bulk assign case on. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="userName" type="string" required>
  The user name of the new assignee.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Bulk change case priority

Action ID: `tools.google_chronicle.bulk_change_case_priority`

Changes the priority level for multiple cases in bulk.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkChangePriority](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkChangePriority)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="casesIds" type="array[integer]" required>
  Cases to change priority for.
</ParamField>

<ParamField path="instance" type="string" required>
  The instance to execute bulk change priority on. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="priority" type="string" required>
  The priority to change the cases to. For example, "Informative", "Low", "Medium", "High", "Critical".
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Bulk change case stage

Action ID: `tools.google_chronicle.bulk_change_case_stage`

Updates the case stage for multiple cases in bulk.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkChangeStage](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkChangeStage)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="casesIds" type="array[integer]" required>
  Cases to change stage for.
</ParamField>

<ParamField path="instance" type="string" required>
  The instance to execute bulk change stage on. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="stage" type="string" required>
  The case stage to change.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Bulk close cases

Action ID: `tools.google_chronicle.bulk_close_cases`

Closes multiple cases in a single operation. A valid closure reason and root cause must be provided for all affected cases.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkClose](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkClose)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="casesIds" type="array[integer]" required>
  Cases to close.
</ParamField>

<ParamField path="closeReason" type="string" required>
  Close reason. One of CLOSE\_REASON\_UNSPECIFIED, MALICIOUS, NOT\_MALICIOUS, MAINTENANCE, INCONCLUSIVE, UNKNOWN.
</ParamField>

<ParamField path="instance" type="string" required>
  The instance to execute bulk close on. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="closeComment" type="string | null">
  Comment to add to the cases when closing them.

  Default: `null`.
</ParamField>

<ParamField path="dynamicParameters" type="array[object] | null">
  Dynamic parameters added to the close case action. Each entry carries id (integer) and values (list of strings).

  Default: `null`.
</ParamField>

<ParamField path="rootCause" type="string | null">
  Root cause of closing the cases.

  Default: `null`.
</ParamField>

## Bulk reopen cases

Action ID: `tools.google_chronicle.bulk_reopen_cases`

Reopens multiple previously closed cases in a single operation. A comment explaining the reason for reopening is required.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkReopen](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/executeBulkReopen)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="casesIds" type="array[integer]" required>
  Cases to reopen.
</ParamField>

<ParamField path="instance" type="string" required>
  The instance to execute bulk reopen on. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="reopenComment" type="string" required>
  Comment to add to the cases when reopening them.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Call API

Action ID: `tools.google_chronicle.call_api`

Call a Chronicle REST API endpoint and return its response body.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest](https://docs.cloud.google.com/chronicle/docs/reference/rest)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="method" type="string" required>
  HTTP method for the Chronicle REST API request.
</ParamField>

<ParamField path="url" type="string" required>
  Full Google Chronicle REST API URL, including the API version and resource path.
</ParamField>

<ParamField path="params" type="object | null">
  Query parameters for the Chronicle API method.

  Default: `null`.
</ParamField>

<ParamField path="payload" type="object | null">
  JSON request body for the Chronicle API method.

  Default: `null`.
</ParamField>

<ParamField path="timeout" type="number | null">
  Request timeout in seconds. Set to null to disable it.

  Default: `60.0`.
</ParamField>

## Cancel operation

Action ID: `tools.google_chronicle.cancel_operation`

Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. On successful cancellation the operation is not deleted; it becomes an operation with an error value whose code is CANCELLED.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.operations/cancel](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.operations/cancel)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="operation" type="string" required>
  The ID of the operation resource to be cancelled.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Change case alert priority

Action ID: `tools.google_chronicle.change_case_alert_priority`

Updates the priority of a CaseAlert.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/patch](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/patch)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case the alert belongs to.
</ParamField>

<ParamField path="caseAlert" type="string" required>
  The ID of the CaseAlert to update.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="priority" type="string" required>
  The alert priority. One of LEGACY\_CASE\_PRIORITY\_UNSPECIFIED, UNCHANGED, INFORMATIVE, LOW, MEDIUM, HIGH, CRITICAL. The default value is HIGH.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Change case priority

Action ID: `tools.google_chronicle.change_case_priority`

Updates the priority of a Case.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/patch](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/patch)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case to update.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="priority" type="string" required>
  Case priority. For example, "Informative", "Low", "Medium", "High", "Critical". The default value is HIGH.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Change case stage

Action ID: `tools.google_chronicle.change_case_stage`

Updates the stage of a Case.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/patch](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/patch)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case to update.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="stage" type="string" required>
  The stage of the Case. For example, "Triage", "Incident", "Investigation". Stages are defined in "chronicle.googleapis.com/CaseStageDefinition". The default stage option is "Triage".
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Close case alert

Action ID: `tools.google_chronicle.close_case_alert`

Closes a CaseAlert. The vendor requires a valid closure reason and comment when closing an alert.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/patch](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/patch)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case the alert belongs to.
</ParamField>

<ParamField path="caseAlert" type="string" required>
  The ID of the CaseAlert to close.
</ParamField>

<ParamField path="comment" type="string" required>
  Alert closure comment.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="reason" type="string" required>
  Alert closure reason. One of CLOSE\_REASON\_UNSPECIFIED, MALICIOUS, NOT\_MALICIOUS, MAINTENANCE, INCONCLUSIVE, UNKNOWN.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="rootCause" type="string | null">
  Alert closure root cause.

  Default: `null`.
</ParamField>

## Create case comment

Action ID: `tools.google_chronicle.create_case_comment`

Creates a new CaseComment. Use this method to add investigative notes or collaborate with other analysts. Comments can optionally include base64 encoded attachments.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/create](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/create)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case this CaseComment will be created on.
</ParamField>

<ParamField path="comment" type="string" required>
  The content of the comment.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="alertIdentifier" type="string | null">
  The alert associated with the comment.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="caseAttachment" type="object | null">
  The attachment associated with the comment. Required fields when present: attachmentBase64 (base64 encoded attachment), fileType, fileName.

  Default: `null`.
</ParamField>

<ParamField path="isFavorite" type="boolean | null">
  Whether the comment is marked as a favorite.

  Default: `null`.
</ParamField>

## Create retrohunt

Action ID: `tools.google_chronicle.create_retrohunt`

Creates a Retrohunt, an execution of a Rule over a time range in the past.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.retrohunts/create](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.retrohunts/create)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="endTime" type="string" required>
  Exclusive end of the event time range this retrohunt processes, in RFC 3339 format.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="rule" type="string" required>
  The rule the retrohunt belongs to, optionally suffixed with `@&#123;revisionId&#125;`. A retrohunt is the child of a rule revision.
</ParamField>

<ParamField path="startTime" type="string" required>
  Inclusive start of the event time range this retrohunt processes, in RFC 3339 format, e.g. "2014-10-02T15:01:23Z".
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Create rule

Action ID: `tools.google_chronicle.create_rule`

Creates a new Rule.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/create](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/create)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  The parent resource where this rule will be created. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="text" type="string" required>
  The YARA-L content of the rule.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="scope" type="string | null">
  Resource name of the DataAccessScope bound to this rule. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. Format: projects/\{project}/locations/\{location}/instances/\{instance}/dataAccessScopes/\{scope}

  Default: `null`.
</ParamField>

## Delete case comment

Action ID: `tools.google_chronicle.delete_case_comment`

Performs a soft delete of a CaseComment, removing the comment's content from general view while preserving its metadata for audit purposes.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/delete](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/delete)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case the comment belongs to.
</ParamField>

<ParamField path="caseComment" type="string" required>
  The ID of the CaseComment to delete.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Delete rule

Action ID: `tools.google_chronicle.delete_rule`

Deletes a Rule.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/delete](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/delete)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="rule" type="string" required>
  The rule ID of the rule to delete. A rule revision timestamp cannot be specified as part of the name, as deleting specific revisions is not supported.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="force" type="boolean | null">
  If set to true, any retrohunts and any detections associated with the rule will also be deleted. If set to false, the call will only succeed if the rule has no associated retrohunts, including completed retrohunts, and no associated detections. Regardless of this field's value, the rule deployment associated with this rule will also be deleted.

  Default: `null`.
</ParamField>

## Disable rule

Action ID: `tools.google_chronicle.disable_rule`

Stops a rule from running against incoming data by clearing `enabled` on its RuleDeployment.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/updateDeployment](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/updateDeployment)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="rule" type="string" required>
  The rule ID whose deployment to disable. RuleDeployment is a child of the overall Rule, not any individual revision, so this must not reference a specific revision.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Enable rule

Action ID: `tools.google_chronicle.enable_rule`

Deploys a rule continuously against incoming data by setting `enabled` on its RuleDeployment.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/updateDeployment](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/updateDeployment)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="rule" type="string" required>
  The rule ID whose deployment to enable. RuleDeployment is a child of the overall Rule, not any individual revision, so this must not reference a specific revision.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Execute query

Action ID: `tools.google_chronicle.execute_query`

Performs a UDM search that returns matching events, or statistics rows, for the query.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/udmSearch](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/udmSearch)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="endTime" type="string" required>
  Exclusive end of the time range to search, as an RFC 3339 timestamp.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="query" type="string" required>
  The UDM query to run, including event, statistics, or SQL queries.
</ParamField>

<ParamField path="startTime" type="string" required>
  Inclusive start of the time range to search, as an RFC 3339 timestamp, e.g. "2014-10-02T15:01:23Z".
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of results to return. Chronicle coerces values over 10000 to 10000.

  Default: `100`.
</ParamField>

<ParamField path="queryDialect" type="string">
  Language of the query string. Chronicle supports YL2 and SQL.

  Default: `"YL2"`.
</ParamField>

<ParamField path="timeout" type="number | null">
  Request timeout in seconds. Set to null to disable it.

  Default: `60.0`.
</ParamField>

## Find entity

Action ID: `tools.google_chronicle.find_entity`

Identifies the entity type and retrieves relevant data associated with a specified indicator.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findEntity](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findEntity)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="entityNamespace" type="string" required>
  Namespace of the entity being queried.
</ParamField>

<ParamField path="indicator" type="string" required>
  Entity indicator to search for.
</ParamField>

<ParamField path="instance" type="string" required>
  The ID of the Instance to find entity for. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="referenceTime" type="string" required>
  Reference time to lookup entity, in RFC 3339 format, e.g. "2014-10-02T15:01:23Z".
</ParamField>

<ParamField path="udmField" type="string" required>
  The UDM field the entity indicator belongs to.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Find entity alerts

Action ID: `tools.google_chronicle.find_entity_alerts`

Gets alerts for an entity. The API returns a maximum of 1000 alerts for the requested entity.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findEntityAlerts](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findEntityAlerts)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="endTime" type="string" required>
  Exclusive end of the time range to retrieve the alerts for, in RFC 3339 format.
</ParamField>

<ParamField path="instance" type="string" required>
  The ID of the Instance to summarize entity for. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="startTime" type="string" required>
  Inclusive start of the time range to retrieve the alerts for, in RFC 3339 format, e.g. "2014-10-02T15:01:23Z".
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="entityId" type="string | null">
  ID of the entity. Use this or the `field_and_value_*` inputs to identify the entity.

  Default: `null`.
</ParamField>

<ParamField path="field_and_value_entity_namespace" type="string | null">
  Entity namespace, applicable to asset entities.

  Default: `null`.
</ParamField>

<ParamField path="field_and_value_field_path" type="string | null">
  UDM field path identifying the indicator type.

  Default: `null`.
</ParamField>

<ParamField path="field_and_value_value" type="string | null">
  Indicator value used to identify the entity.

  Default: `null`.
</ParamField>

<ParamField path="field_and_value_value_type" type="string | null">
  Chronicle value type identifying the indicator type.

  Default: `null`.
</ParamField>

## Find related entities

Action ID: `tools.google_chronicle.find_related_entities`

Finds all the entities associated with provided entity. The API returns a maximum of 100 entities.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findRelatedEntities](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findRelatedEntities)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="endTime" type="string" required>
  Exclusive end of the time range to search related entities for, in RFC 3339 format.
</ParamField>

<ParamField path="instance" type="string" required>
  The name of the parent resource, which is the SecOps instance to find related entities for. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="startTime" type="string" required>
  Inclusive start of the time range to search related entities for, in RFC 3339 format, e.g. "2014-10-02T15:01:23Z".
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="domainType" type="string | null">
  The domain type to retrieve. This is taken into account when the entity type is specified as "DOMAIN\_NAME".

  Default: `null`.
</ParamField>

<ParamField path="entityId" type="string | null">
  ID of the entity. Use this or the `field_and_value_*` inputs to identify the entity.

  Default: `null`.
</ParamField>

<ParamField path="entityTypes" type="array[string] | null">
  Entity types to filter related entities by. If unspecified, will return all related entities for the given entity.

  Default: `null`.
</ParamField>

<ParamField path="excludeFirstLastSeen" type="boolean | null">
  If true, then the related entities will not have first/last seen info and reduce latency of endpoint.

  Default: `null`.
</ParamField>

<ParamField path="field_and_value_entity_namespace" type="string | null">
  Entity namespace, applicable to asset entities.

  Default: `null`.
</ParamField>

<ParamField path="field_and_value_field_path" type="string | null">
  UDM field path identifying the indicator type.

  Default: `null`.
</ParamField>

<ParamField path="field_and_value_value" type="string | null">
  Indicator value used to identify the entity.

  Default: `null`.
</ParamField>

<ParamField path="field_and_value_value_type" type="string | null">
  Chronicle value type identifying the indicator type.

  Default: `null`.
</ParamField>

<ParamField path="includeAllUdmEventTypesForFirstLastSeen" type="boolean | null">
  If true, it includes all types of events we show in UDM Search to calculate the first and last seen time of an entity.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of Entities to return. The service may return fewer than this value. If unspecified, at most 100 entities will be returned. The maximum value is 100; values above 100 will be coerced to 100.

  Default: `null`.
</ParamField>

## Find UDM field values

Action ID: `tools.google_chronicle.find_udm_field_values`

Finds ingested UDM field values that match a query.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findUdmFieldValues](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/findUdmFieldValues)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="query" type="string" required>
  The partial UDM field value to match.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of value matches to return. The service may return fewer matches than this value. If unspecified, defaults to 250. The maximum value is 1000; values above 1000 will be coerced to 1000.

  Default: `null`.
</ParamField>

## Get alert

Action ID: `tools.google_chronicle.get_alert`

RPC for fetching an alert based on its Alert Id.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetAlert](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetAlert)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="alertId" type="string" required>
  The ID of the collection to return.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="includeDetections" type="boolean | null">
  If set to true, response will include non-alerting detections.

  Default: `null`.
</ParamField>

## Get case

Action ID: `tools.google_chronicle.get_case`

Gets a single Case by its resource name, including its alerts, entities, and investigation history.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/get](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/get)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case to retrieve.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="expand" type="string | null">
  Expand field for getting related resources.

  Default: `null`.
</ParamField>

## Get case alert

Action ID: `tools.google_chronicle.get_case_alert`

Gets a single CaseAlert, including its current status, priority, and associated metadata.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/get](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/get)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case the alert belongs to.
</ParamField>

<ParamField path="caseAlert" type="string" required>
  The ID of the CaseAlert to retrieve.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="expand" type="string | null">
  Expand the response to include the full alert object. Supported values: sla, involvedRelations. Example: "sla, involvedRelations"

  Default: `null`.
</ParamField>

## Get case comment

Action ID: `tools.google_chronicle.get_case_comment`

Gets a single CaseComment by its resource name, returning the content and metadata of a specific comment.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/get](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/get)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case the comment belongs to.
</ParamField>

<ParamField path="caseComment" type="string" required>
  The ID of the CaseComment to retrieve.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="expand" type="string | null">
  Expand field for getting related resources.

  Default: `null`.
</ParamField>

## Get detection

Action ID: `tools.google_chronicle.get_detection`

Legacy endpoint for fetching a Detection.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetDetection](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetDetection)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="detectionId" type="string" required>
  The detection to get.
</ParamField>

<ParamField path="instance" type="string" required>
  The name of the parent resource, which is the SecOps instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="ruleId" type="string" required>
  The specific rule revision to get a detection for. There are two acceptable formats: "\{ruleId}" gets a detection for the latest revision of the Rule, and "\{ruleId}@\{revisionId}" gets a detection for that revision.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Get event for detection

Action ID: `tools.google_chronicle.get_event_for_detection`

Legacy endpoint for getting event for curated detection.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetEventForDetection](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetEventForDetection)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="detectionId" type="string" required>
  The unique ID of the curated detection, as a base64-encoded string.
</ParamField>

<ParamField path="instance" type="string" required>
  The name of the parent resource, which is the SecOps instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="next_page_token_last_row_id" type="string | null">
  Last row ID from the previous response page token.

  Default: `null`.
</ParamField>

<ParamField path="next_page_token_last_row_time" type="string | null">
  Last row timestamp from the previous response page token.

  Default: `null`.
</ParamField>

<ParamField path="next_page_token_offset" type="integer | null">
  Offset from the previous response page token.

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  Number of events to return per page. Default value is 1000 if the pageSize is not set in the request.

  Default: `null`.
</ParamField>

## Get operation

Action ID: `tools.google_chronicle.get_operation`

Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.operations/get](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.operations/get)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="operation" type="string" required>
  The ID of the operation resource.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Get retrohunt

Action ID: `tools.google_chronicle.get_retrohunt`

Gets a Retrohunt.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.retrohunts/get](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.retrohunts/get)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="retrohunt" type="string" required>
  The ID of the retrohunt to retrieve.
</ParamField>

<ParamField path="rule" type="string" required>
  The rule the retrohunt belongs to, optionally suffixed with `@&#123;revisionId&#125;`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Get rule

Action ID: `tools.google_chronicle.get_rule`

Gets a Rule.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/get](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/get)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="rule" type="string" required>
  The rule ID of the rule to retrieve, optionally suffixed with `@&#123;revisionId&#125;` to pin a revision.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="view" type="string | null">
  The scope of fields to populate for the Rule being returned. If unspecified, defaults to FULL. One of BASIC, FULL, REVISION\_METADATA\_ONLY.

  Default: `null`.
</ParamField>

## Get rule deployment

Action ID: `tools.google_chronicle.get_rule_deployment`

Gets a RuleDeployment.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/getDeployment](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/getDeployment)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="rule" type="string" required>
  The rule ID whose deployment to retrieve. RuleDeployment is a child of the overall Rule, not any individual revision, so this must not reference a specific revision.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## List case alerts

Action ID: `tools.google_chronicle.list_case_alerts`

Lists CaseAlerts within a specific Case. Supports filtering by status, priority, and other alert attributes.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/list](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/list)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case to list CaseAlerts for.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="distinctBy" type="string | null">
  Fields to distinct results. Example: caseId

  Default: `null`.
</ParamField>

<ParamField path="expand" type="string | null">
  Expand the response to include the full alert object. Supported values: sla, involvedRelations. Example: "sla, involvedRelations"

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  A filter to apply to the list of CaseAlerts. Supported filter fields: displayName, caseId, identifier, sourceGroupingIdentifier, product, vendor, environment, ticketId, sourceSystemName, creation\_method, priority, status, startTime, endTime, additionalProperties, involvedRelations. Example: filter="displayName='some\_name'"

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  Configures ordering of CaseAlerts in the response. If not specified, CaseAlerts are returned in descending order of their create time. The orderBy string is a comma separated list of fields. Example: "displayName desc, default"

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The maximum number of CaseAlerts to return. The service may return fewer than this value. If unspecified, at most 50 CaseAlerts will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  A page token, received from a previous caseAlerts.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to caseAlerts.list must match the call that provided the page token.

  Default: `null`.
</ParamField>

## List case comments

Action ID: `tools.google_chronicle.list_case_comments`

Lists CaseComments associated with a specific Case. Supports filtering by author, creation time and other fields.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/list](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/list)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case to list CaseComments for.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="expand" type="string | null">
  Expand the response to include the full comment object. Supported values: caseAttachment

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  A filter to apply to the list of CaseComments. Supported filter fields: createTime, updateTime, user, comment, deletionInvoker, favorite, alert, deleted. Example: filter="comment='some\_comment'"

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  Configures ordering of CaseComments in the response. If not specified, CaseComments are returned in descending order of their create time. Supported sort fields: createTime, updateTime, user, comment, deletionInvoker, favorite, alert, deleted. For example: "comment desc, favorite"

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The maximum number of CaseComments to return. The service may return fewer than this value. If unspecified, at most 50 CaseComments will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  A page token, received from a previous caseComments.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters must match the call that provided the page token.

  Default: `null`.
</ParamField>

## List cases

Action ID: `tools.google_chronicle.list_cases`

Lists Cases in an instance. Supports extensive filtering and ordering based on case attributes like priority, status, assignee and more.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/list](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases/list)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  The instance to list Cases for. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="distinctBy" type="string | null">
  The field to distinct the cases by.

  Default: `null`.
</ParamField>

<ParamField path="expand" type="string | null">
  Expand the response to include the full case object. Supported values: tasks, tags, products. Example: "tags, products"

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  A filter to apply to the list of Cases. Supported filter fields: displayName, creatorUserId, creatorUser, lastModifyingUserId, lastModifyingUser, assignee, assignedUser, stage, priority, important, type, environment, case\_data\_state, score, alertsSla, sla, tags, products, closureDetails, tasks. Example: filter="displayName='some\_name'"

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  Configures ordering of Cases in the response. If not specified, Cases are returned in descending order of their create time. The orderBy string is a comma separated list of fields. Example: "displayName desc, priority"

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The maximum number of cases to return. The service may return fewer than this value. If unspecified, at most 50 Cases will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  A page token, received from a previous cases.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to cases.list must match the call that provided the page token.

  Default: `null`.
</ParamField>

## List detections

Action ID: `tools.google_chronicle.list_detections`

Legacy endpoint for searching detections for a rule version.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacySearchDetections](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacySearchDetections)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="ruleId" type="string" required>
  The specific rule revision to search detections for. There are four acceptable formats: "\{ruleId}" retrieves detections for the latest revision of the Rule; "\{ruleId}@\{revisionId}" retrieves detections for that revision; "\{ruleId}@-" retrieves detections for all revisions of the Rule; "-" retrieves detections for all revisions of all Rules.
</ParamField>

<ParamField path="alertState" type="string | null">
  An enum that filters which detections are returned by their AlertState. One of UNSPECIFIED, NOT\_ALERTING, ALERTING.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="endTime" type="string | null">
  The time to end searching detections to, exclusive, in RFC 3339 format.

  Default: `null`.
</ParamField>

<ParamField path="includeNestedDetections" type="boolean | null">
  If true, include one level of nested detections in the response.

  Default: `null`.
</ParamField>

<ParamField path="includeSimulatedDetections" type="boolean | null">
  Deprecated. If true, include simulated detections in the response. Prefer simulatedDataVisibility for new workflows.

  Default: `null`.
</ParamField>

<ParamField path="listBasis" type="string | null">
  Basis for determining whether to apply startTime and endTime filters for detection time or creation time of the detection. One of LIST\_BASIS\_UNSPECIFIED, DETECTION\_TIME, CREATED\_TIME.

  Default: `null`.
</ParamField>

<ParamField path="maxRespSizeBytes" type="integer | null">
  The maximum size of response in bytes. If it is set to 0 (or is omitted), the server will not enforce any max response size limit.

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  Maximum number of detections to return.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  A page token, received from a previous legacy.legacySearchDetections call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to legacy.legacySearchDetections must match the call that provided the page token.

  Default: `null`.
</ParamField>

<ParamField path="simulatedDataVisibility" type="string | null">
  Specifies visibility of simulated data to include in search results.

  Default: `null`.
</ParamField>

<ParamField path="startTime" type="string | null">
  The time to start search detections from, inclusive, in RFC 3339 format, e.g. "2014-10-02T15:01:23Z".

  Default: `null`.
</ParamField>

## List operations

Action ID: `tools.google_chronicle.list_operations`

Lists operations that match the specified filter in the request. If the server doesn't support this method, it returns UNIMPLEMENTED.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.operations/list](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.operations/list)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  The name of the operation's parent resource. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  The standard list filter.

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The standard list page size.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  The standard list page token.

  Default: `null`.
</ParamField>

<ParamField path="returnPartialSuccess" type="boolean | null">
  Return reachable operations normally and report unreachable collections in the response. Chronicle may return UNIMPLEMENTED when this option is unsupported.

  Default: `null`.
</ParamField>

## List retrohunts

Action ID: `tools.google_chronicle.list_retrohunts`

Lists Retrohunts.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.retrohunts/list](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.retrohunts/list)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="rule" type="string" required>
  The rule that the retrohunts belong to. Use "-" to list retrohunts across all rules.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  A filter that can be used to retrieve specific retrohunts. The following fields are filterable: state

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The maximum number of retrohunt to return. The service may return fewer than this value. If unspecified, at most 100 retrohunts will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  A page token, received from a previous retrohunts.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to retrohunts.list must match the call that provided the page token.

  Default: `null`.
</ParamField>

## List rule deployments

Action ID: `tools.google_chronicle.list_rule_deployments`

Lists RuleDeployments across all Rules.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.deployments/list](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules.deployments/list)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}. The "-" wildcard token is used as the rule identifier so deployments across all rules are returned.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  A filter that can be used to retrieve specific rule deployments. The following fields are filterable: archived, name

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The maximum number of rule deployments to return. The service may return fewer than this value. If unspecified, at most 100 rule deployments will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  A page token, received from a previous deployments.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to deployments.list must match the call that provided the page token.

  Default: `null`.
</ParamField>

## List rule execution errors

Action ID: `tools.google_chronicle.list_rule_execution_errors`

Lists rule execution errors.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.ruleExecutionErrors/list](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.ruleExecutionErrors/list)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  The instance to list rule execution errors from. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  A filter that can be used to retrieve specific rule execution errors. Only the following filters are allowed: rule = "\{Rule.name}", curatedRule = "\{CuratedRule.name}". For 'rule' an optional revision id may be appended as "\{Rule.name}@\{Rule.revision\_id}", or "\{Rule.name}@-" to fetch errors across all revisions. Revision IDs are not supported for curated rules.

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The maximum number of rule execution errors to return. The service may return fewer than this value. If unspecified, at most 1000 rule execution errors will be returned. The maximum value is 10000; values above 10000 will be coerced to 10000.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  A page token, received from a previous ruleExecutionErrors.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to ruleExecutionErrors.list must match the call that provided the page token.

  Default: `null`.
</ParamField>

## List rule revisions

Action ID: `tools.google_chronicle.list_rule_revisions`

Lists all revisions of a rule.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/listRevisions](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/listRevisions)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="rule" type="string" required>
  The rule ID of the rule to list revisions for.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The maximum number of revisions to return per page. The service may return fewer than this value. If unspecified, at most 100 revisions will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  The page token, received from a previous rules.listRevisions call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to rules.listRevisions must match the call that provided the page token.

  Default: `null`.
</ParamField>

<ParamField path="view" type="string | null">
  The scope of fields to populate for the revision being returned. If unspecified, defaults to BASIC. One of BASIC, FULL, REVISION\_METADATA\_ONLY.

  Default: `null`.
</ParamField>

## List rules

Action ID: `tools.google_chronicle.list_rules`

Lists Rules.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/list](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/list)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  The parent, which owns this collection of rules. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  Only the following filters are allowed: "referenceLists:\{reference\_list\_name}" "dataTables:\{dataTableName}" "displayName:\{displayName}"

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  The sort order of the rules. If unspecified, rules will be sorted by revisionCreateTime desc ruleId asc. Sorting is supported on a single field only. Supported fields: "archived", "alertingEnabled", "author", "createTime", "currentDayDetectionCount", "displayName", "executionState", "liveModeEnabled", "revisionCreateTime", "ruleId", "ruleOwner", "severity", "type". Example: "displayName desc"

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The maximum number of rules to return. The service may return fewer than this value. If unspecified, at most 100 rules will be returned. The maximum value is 1000, or 5000 if `view` is set to CONFIG\_ONLY; values above the applicable maximum will be coerced to that maximum.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  A page token, received from a previous rules.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to rules.list must match the call that provided the page token.

  Default: `null`.
</ParamField>

<ParamField path="skip" type="integer | null">
  The number of rules to skip in the response. Skipping is only supported in TRENDS view.

  Default: `null`.
</ParamField>

<ParamField path="view" type="string | null">
  The scope of fields to populate for the Rule being returned. If unspecified, defaults to BASIC. One of BASIC, FULL, REVISION\_METADATA\_ONLY, CONFIG\_ONLY, TRENDS.

  Default: `null`.
</ParamField>

## Reopen case alert

Action ID: `tools.google_chronicle.reopen_case_alert`

Reopens a closed CaseAlert by setting its status back to OPEN.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/patch](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseAlerts/patch)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case the alert belongs to.
</ParamField>

<ParamField path="caseAlert" type="string" required>
  The ID of the CaseAlert to reopen.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

## Search alerts

Action ID: `tools.google_chronicle.search_alerts`

Legacy endpoint for getting alerts (and in some cases, non-alerting detections) along with aggregated fields that match the query.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyFetchAlertsView](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyFetchAlertsView)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="endTime" type="string" required>
  Exclusive end of the time range to search, in RFC 3339 format.
</ParamField>

<ParamField path="instance" type="string" required>
  The name of the parent resource, which is the SecOps instance. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="snapshotQuery" type="string" required>
  This uses a syntax similar to UDM search, with support for all fields within 7 levels of nesting within the collection proto. For composite detections, the filters prefixed with "collectionElements.references.event" or "collectionElements.references.entity" are also checked against one-level of producer detections.
</ParamField>

<ParamField path="startTime" type="string" required>
  Inclusive start of the time range to search, in RFC 3339 format, e.g. "2014-10-02T15:01:23Z".
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="baselineQuery" type="string | null">
  The baseline query is used for this request and its results are cached for subsequent requests, so that supplying additional filters in the snapshotQuery will not require re-running the baseline query. This uses a syntax similar to UDM search, and all fields are supported except for the path prefix `feedbackSummary.*`.

  Default: `null`.
</ParamField>

<ParamField path="enableCache" type="string | null">
  If enabled, subsequent requests for the same time range and baseline query will try to leverage our cache to serve the response with filters applied in the snapshot query. One of ALERTS\_FEATURE\_PREFERENCE\_UNSPECIFIED, ALERTS\_FEATURE\_PREFERENCE\_ENABLED, ALERTS\_FEATURE\_PREFERENCE\_DISABLED.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_asset_ip_address" type="string | null">
  Asset IP address entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_destination_ip_address" type="string | null">
  Destination IP entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_domain_name" type="string | null">
  Domain name entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_email" type="string | null">
  Email entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_employee_id" type="string | null">
  Employee ID entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_file_path" type="string | null">
  File path entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_full_command_line" type="string | null">
  Full command line entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_hash_md5" type="string | null">
  MD5 hash entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_hash_sha1" type="string | null">
  SHA-1 hash entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_hash_sha256" type="string | null">
  SHA-256 hash entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_hostname" type="string | null">
  Hostname entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_mac" type="string | null">
  MAC address entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_namespace" type="string | null">
  Namespace for an asset entity indicator.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_parent_process_id" type="string | null">
  Parent process ID entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_process_id" type="string | null">
  Process ID entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_product_id" type="string | null">
  Product-specific asset ID indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_product_object_id" type="string | null">
  Product object ID entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_raw_pid" type="string | null">
  Raw process ID entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_resource_name" type="string | null">
  Resource name entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_user_name" type="string | null">
  User name entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="entity_indicator_windows_sid" type="string | null">
  Windows SID entity indicator. Set at most one indicator value.

  Default: `null`.
</ParamField>

<ParamField path="includeNonAlertingDetections" type="string | null">
  Whether to include non-alerting detections in the response. One of ALERTS\_FEATURE\_PREFERENCE\_UNSPECIFIED, ALERTS\_FEATURE\_PREFERENCE\_ENABLED, ALERTS\_FEATURE\_PREFERENCE\_DISABLED.

  Default: `null`.
</ParamField>

<ParamField path="maxResponseAlertsBytes" type="string | null">
  The maximum size, in bytes, of the alerts data returned in the response, as an int64 string. If the total size of alerts exceeds this limit, the list of alerts is truncated and `memoryLimitExceeded` is set in the response. If unspecified or set to 0, no size limit is applied.

  Default: `null`.
</ParamField>

<ParamField path="max_returned_alerts" type="integer | null">
  Parameter for the Alerts that will be streamed back; caps the number of matched alerts returned in `alerts`.

  Default: `null`.
</ParamField>

<ParamField path="max_values_per_field" type="integer | null">
  Parameter for the Aggregated Alert fields that will be streamed back; caps the number of values returned per aggregated field.

  Default: `null`.
</ParamField>

<ParamField path="simulatedDataVisibility" type="string | null">
  Specifies visibility of simulated data to include in search results.

  Default: `null`.
</ParamField>

## Search cases

Action ID: `tools.google_chronicle.search_cases`

Performs a search for security cases matching the provided criteria. Returns a list of investigations based on status, priority, environment, and associated metadata.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacySearches/legacyCaseSearchEverything](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacySearches/legacyCaseSearchEverything)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  The instance to get the search results for. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="assignedUsers" type="array[string] | null">
  A list of strings that represents the Users (analysts) / Roles that are assigned to the case. Available inputs: Username (GUID) / @Role name.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="caseComment" type="string | null">
  A string that represents a part of the body of a case comment to search for in cases.

  Default: `null`.
</ParamField>

<ParamField path="caseSource" type="array[string] | null">
  List of strings representing case sources. Available inputs: System / Manual / Test.

  Default: `null`.
</ParamField>

<ParamField path="categoryOutcomes" type="array[string] | null">
  List of strings that represents whether to fetch cases that contain a specific value in CategoryOutcome. Available inputs: Allowed / Blocked / \[] (empty).

  Default: `null`.
</ParamField>

<ParamField path="closeReason" type="string | null">
  Represents the reason the case was closed and fetches cases that match the value.

  Default: `null`.
</ParamField>

<ParamField path="disableTimeRangeLocalization" type="boolean | null">
  A boolean field that represents whether the Localization (timezone) settings should be ignored. Applies to startTime and endTime. Available inputs: true / false / null.

  Default: `null`.
</ParamField>

<ParamField path="endTime" type="string | null">
  The UTC end time to search for cases by creation time, in RFC 3339 format. Used if timeRangeFilter is set to the custom filter. Defaults to current time.

  Default: `null`.
</ParamField>

<ParamField path="environments" type="array[string] | null">
  List of strings representing the environments that the case is associated with. If the case matches at least one environment it will be fetched.

  Default: `null`.
</ParamField>

<ParamField path="externalAlertId" type="string | null">
  Represents the 'TicketId' mapped from the original SIEM's alert ID.

  Default: `null`.
</ParamField>

<ParamField path="importance" type="array[string] | null">
  List of strings representing the case importance (i.e. marked as "is important"). Available inputs: True / False.

  Default: `null`.
</ParamField>

<ParamField path="incident" type="array[string] | null">
  List of strings representing cases marked as incidents. Available inputs: True / False.

  Default: `null`.
</ParamField>

<ParamField path="involvedEntity" type="string | null">
  A string that represents an entity to search for in cases.

  Default: `null`.
</ParamField>

<ParamField path="isCaseClosed" type="boolean | null">
  A boolean field that represents whether to filter by the case status (is closed or not). Available inputs: true / false / null.

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  Number of entries to return.

  Default: `null`.
</ParamField>

<ParamField path="paging" type="object | null">
  Paging options for the search.

  Default: `null`.
</ParamField>

<ParamField path="ports" type="array[string] | null">
  List of strings that represent the ports that exist in the case. If the case matches at least one Port it will be fetched.

  Default: `null`.
</ParamField>

<ParamField path="priorities" type="array[string] | null">
  List of strings representing case priority.

  Default: `null`.
</ParamField>

<ParamField path="products" type="array[string] | null">
  List of strings that represent the Products that exists in the case. If the case matches at least one Product it will be fetched.

  Default: `null`.
</ParamField>

<ParamField path="requestedPage" type="integer | null">
  The requested page.

  Default: `null`.
</ParamField>

<ParamField path="ruleGenerator" type="array[string] | null">
  List of strings that represents the Rule Generator (Alert Type in the Platform) that exist in the case.

  Default: `null`.
</ParamField>

<ParamField path="searchTerm" type="string | null">
  Search term.

  Default: `null`.
</ParamField>

<ParamField path="sortBy" type="object | null">
  The sort by property and order.

  Default: `null`.
</ParamField>

<ParamField path="stage" type="array[string] | null">
  List of strings that represents the Stages that case is on. Available inputs: Triage / Assessment / Investigation / Incident / Improvement / Research.

  Default: `null`.
</ParamField>

<ParamField path="startTime" type="string | null">
  The UTC start time to search for cases by creation time, in RFC 3339 format. Used if timeRangeFilter is set to the custom filter. Defaults to the start of epoch time.

  Default: `null`.
</ParamField>

<ParamField path="tags" type="array[string] | null">
  List of strings representing case tags. If one or more tags exist in the case, it will be fetched.

  Default: `null`.
</ParamField>

<ParamField path="timeRangeFilter" type="string | null">
  Represents the number of days back to search cases by creation time. For a custom time range use 0 and set the startTime and endTime parameters.

  Default: `null`.
</ParamField>

<ParamField path="title" type="string | null">
  A string that represents free text / search term to search for cases. Available inputs: free text / Entity: / AlertName: / DestinationEntity: / SourceEntity: / TicketIds: / CaseIDs:

  Default: `null`.
</ParamField>

## Search findings

Action ID: `tools.google_chronicle.search_findings`

Legacy endpoint for listing Findings.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacySearchFindings](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacySearchFindings)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="endTime" type="string" required>
  Exclusive end of the times range to get the findings from, in RFC 3339 format.
</ParamField>

<ParamField path="findingType" type="array[string]" required>
  Finding type: Uppercase, DSML, etc.
</ParamField>

<ParamField path="instance" type="string" required>
  The name of the parent resource, which is the SecOps instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="startTime" type="string" required>
  Inclusive start of the times range to get the findings from, in RFC 3339 format, e.g. "2014-10-02T15:01:23Z".
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="next_page_token_last_row_id" type="string | null">
  Last row ID from the previous response page token.

  Default: `null`.
</ParamField>

<ParamField path="next_page_token_last_row_time" type="string | null">
  Last row timestamp from the previous response page token.

  Default: `null`.
</ParamField>

<ParamField path="next_page_token_offset" type="integer | null">
  Offset from the previous response page token.

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  Number of findings to return per page. Default value is 1000 if the pageSize is not set in the request.

  Default: `null`.
</ParamField>

## Test rule

Action ID: `tools.google_chronicle.test_rule`

Runs a rule text over a bounded historical time range without creating a rule.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyRunTestRule](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyRunTestRule)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="endTime" type="string" required>
  Exclusive end of the time range the rule should be tested on, in RFC 3339 format. The range is limited to 14 days.
</ParamField>

<ParamField path="instance" type="string" required>
  The Chronicle instance associated with the request. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="ruleText" type="string" required>
  The rule text to be tested.
</ParamField>

<ParamField path="startTime" type="string" required>
  Inclusive start of the time range the rule should be tested on, in RFC 3339 format, e.g. "2014-10-02T15:01:23Z".
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="maxResults" type="integer | null">
  The maximum number of results to return. The service may return fewer than this value. If unspecified, at most 1000 detections will be returned. The maximum value is 10000; values above 10000 will be coerced to 10000.

  Default: `null`.
</ParamField>

<ParamField path="scope" type="string | null">
  The data access scope to use to run the rule. This field is only required if data access control is enabled. Format: projects/\{project}/locations/\{location}/instances/\{instance}/dataAccessScopes/\{scope}

  Default: `null`.
</ParamField>

## Update alert

Action ID: `tools.google_chronicle.update_alert`

Legacy endpoint for updating an alert.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyUpdateAlert](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyUpdateAlert)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="alertId" type="string" required>
  The id of the alert.
</ParamField>

<ParamField path="feedback" type="object" required>
  The analyst-supplied feedback on the alert. Writable fields: verdict, reputation, confidenceScore (0-100), riskScore (0-100), disregarded, severity (1-100), comment, status, priority, rootCause, reason, severityDisplay.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="caseName" type="string | null">
  The case name that the alert is associated with.

  Default: `null`.
</ParamField>

<ParamField path="responsePlatformInfo" type="object | null">
  The response platform info of the alert.

  Default: `null`.
</ParamField>

## Update case comment

Action ID: `tools.google_chronicle.update_case_comment`

Updates an existing CaseComment. Use this method to correct or clarify previously added information.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/patch](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.cases.caseComments/patch)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="case" type="string" required>
  The ID of the Case the comment belongs to.
</ParamField>

<ParamField path="caseComment" type="string" required>
  The ID of the CaseComment to update.
</ParamField>

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="updateMask" type="string" required>
  The list of fields to update. This is a comma-separated list of fully qualified names of fields, e.g. "comment". If not included, all fields with default/non-default values will be overwritten.
</ParamField>

<ParamField path="alertIdentifier" type="string | null">
  The alert associated with the comment.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="caseAttachment" type="object | null">
  The attachment associated with the comment. Required fields when present: attachmentBase64 (base64 encoded attachment), fileType, fileName.

  Default: `null`.
</ParamField>

<ParamField path="comment" type="string | null">
  The content of the comment.

  Default: `null`.
</ParamField>

<ParamField path="isFavorite" type="boolean | null">
  Whether the comment is marked as a favorite.

  Default: `null`.
</ParamField>

## Update rule

Action ID: `tools.google_chronicle.update_rule`

Updates a Rule.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/patch](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/patch)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="rule" type="string" required>
  The rule ID of the rule to update.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="scope" type="string | null">
  Resource name of the DataAccessScope bound to this rule. Format: projects/\{project}/locations/\{location}/instances/\{instance}/dataAccessScopes/\{scope}

  Default: `null`.
</ParamField>

<ParamField path="text" type="string | null">
  The YARA-L content of the rule.

  Default: `null`.
</ParamField>

<ParamField path="updateMask" type="string | null">
  The list of fields to update. If not included, all fields with a non-empty value will be overwritten. This is a comma-separated list of fully qualified names of fields, e.g. "text".

  Default: `null`.
</ParamField>

## Update rule deployment

Action ID: `tools.google_chronicle.update_rule_deployment`

Updates a RuleDeployment. Failures are not necessarily atomic. If there is a request to update multiple fields, and any update to a single field fails, an error will be returned, but other fields may remain successfully updated.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/updateDeployment](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.rules/updateDeployment)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  Chronicle instance this request is sent to. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="rule" type="string" required>
  The rule ID whose deployment to update. RuleDeployment is a child of the overall Rule, not any individual revision, so this must not reference a specific revision.
</ParamField>

<ParamField path="updateMask" type="string" required>
  Required. The list of fields to update. This is a comma-separated list of fully qualified names of fields, e.g. "enabled,alerting". Schedule customizations are tied to run frequency and must be updated with the "runFrequency" mask.
</ParamField>

<ParamField path="alerting" type="boolean | null">
  Whether detections resulting from this deployment should be considered alerts.

  Default: `null`.
</ParamField>

<ParamField path="archived" type="boolean | null">
  The archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and runFrequency cannot be updated.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>

<ParamField path="enabled" type="boolean | null">
  Whether the rule is currently deployed continuously against incoming data.

  Default: `null`.
</ParamField>

<ParamField path="runFrequency" type="string | null">
  The run frequency of the rule deployment. One of LIVE, HOURLY, DAILY.

  Default: `null`.
</ParamField>

<ParamField path="scheduleCustomizations" type="object | null">
  The schedule customizations of the rule deployment. Only valid for customizable run frequencies. Documented fields: ensureEnrichmentCompleteness (boolean), lateArrivingDataAdjustment (duration string, e.g. "3.5s").

  Default: `null`.
</ParamField>

## Verify rule text

Action ID: `tools.google_chronicle.verify_rule_text`

Verifies a rule text without creating a rule.

Reference: [https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/verifyRuleText](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances/verifyRuleText)

### Secrets

Optional secrets:

* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_USER_TOKEN`.
* `google_chronicle_oauth`: OAuth token `GOOGLE_CHRONICLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="instance" type="string" required>
  The name of the parent resource, which is the SecOps instance associated with the request. Format: projects/\{project}/locations/\{location}/instances/\{instance}
</ParamField>

<ParamField path="ruleText" type="string" required>
  The rule text to verify as a UTF-8 string.
</ParamField>

<ParamField path="base_url" type="string | null">
  Chronicle API base URL. If omitted, uses the workspace variable `google_chronicle.base_url`, for example [https://us-chronicle.googleapis.com](https://us-chronicle.googleapis.com).

  Default: `null`.
</ParamField>