UserErrorReason

Describes the reason for a user error. Defines the supported values for google.rpc.ErrorInfo.reason for the chronicle.googleapis.com error domain. The metadata keys are specific to each error reason. For more information, see the definition of the specific error reason.

Enums
USER_ERROR_REASON_UNSPECIFIED Do not use this default value.
RULE_REFERENCES_OUT_OF_SCOPE

The rule text references resources, such as reference lists, that are out of scope for the rule.

Example of an ErrorInfo for this reason:

{ "reason": "RULE_REFERENCES_OUT_OF_SCOPE",
  "domain": "chronicle.googleapis.com",
  "metadata": {
    "reference_lists": "list_name1,list_name2,list_name3,",
  }
}
RULE_ARCHIVED The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
RULE_STALE_VERSION The rule version being operated on is not the latest, and so the operation can't be done.
RULE_ACTIVE The rule can't be archived because it is live (detecting) and a retrohunt is running.
RULE_RETROHUNT_RUNNING The rule can't be archived because a retrohunt is running against it.
RULE_LIVE The rule can't be archived because it is live (detecting).
RULE_ALREADY_DISABLED The rule can't be disabled because is is already disabled.
EXPENSIVE_RULE_LARGE_WINDOW The rule's match time window is too large for its current run frequency.
RULE_LIMITED_PAUSED The rule can't be enabled because it has been limited or paused because of high resource use.
REFERENCE_LIST_NOT_FOUND The list being referred to doesn't exist.
UEBA_RULES_NO_SCOPE UEBA rules may not be assigned a data access scope.
RULE_TESTING_INTERVAL_TOO_SHORT

The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled match_window_duration and testing_interval_duration, formatted as Go durations.

Example ErrorInfo:

{ "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
SEARCH_CSV_FIELDS_NOT_SUPPORTED

The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled unsupported_fields.

Example ErrorInfo:

{ "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
INVALID_ARGUMENT_FOR_DASHBOARD_FILTER

Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled filter_name, filter_value, operator, and expected_type, respectively.

Example ErrorInfo:

{ "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
INVALID_CONFIG_FOR_DASHBOARD_IMPORT

Invalid config for dashboard import. Example ErrorInfo:

{ "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
RETROHUNT_LIMIT_REACHED

The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled retrohunt_limit.

Example ErrorInfo:

{ "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
BIG_QUERY_EXPORT_NOT_PROVISIONED

The BigQuery export is not provisioned for this instance.

Example ErrorInfo:

{ "reason": "BIG_QUERY_EXPORT_NOT_PROVISIONED", "domain": "chronicle.googleapis.com", }
BIG_QUERY_EXPORT_BILLING_NOT_ENABLED

The billing is not enabled for the Google Cloud Platform project associated with this instance.

Example ErrorInfo:

{ "reason": "BIG_QUERY_EXPORT_BILLING_NOT_ENABLED", "domain": "chronicle.googleapis.com", }