PreferenceSet

A collection of preferences for a user.

JSON representation 
{
  "name": string,
  "ui_preferences": {
    object (UiPreferences)
  }
}
Fields
name

string

Output only. Identifier. Resource name.
ui_preferences

object (UiPreferences)

Optional. Preferences for UI configuration.

UiPreferences

Collection of preferences for UI configuration.

JSON representation 
{
  "display_timezone": string,
  "search_history": [
    {
      object (SearchHistory)
    }
  ],
  "enable_search_history": boolean,
  "column_sets": [
    {
      object (ColumnSet)
    }
  ],
  "pinned_fields": [
    string
  ],
  "enable_duet_ai_chat": boolean,
  "language_code": string,
  "dismissible_notifications": [
    {
      object (DismissibleNotification)
    }
  ],
  "udm_fields_viewer_pinned_fields": [
    string
  ],
  "search_preferences": {
    object (SearchPreferences)
  }
}
Fields
display_timezone

string

Optional. Timezone for displaying times to the user.
search_history[]

object (SearchHistory)

Optional. Previously run search queries. This will be limited to around 20 queries by the calling UI code.
enable_search_history

boolean

Optional. Flag for enabling saving search history. True if it is enabled.
column_sets[]

object (ColumnSet)

Optional. A list of ColumnSets saved by the user.
pinned_fields[]

string

Optional. A list of fields to pin at the top of the quick filters panel.
enable_duet_ai_chat

boolean

Optional. Flag for user opt-in setting for Duet AI in Chronicle. True if user is opted-in.
language_code

string

Optional. The users's preferred language. -- Set via the URL param hl. --
dismissible_notifications[]

object (DismissibleNotification)

Optional. A list of notifications that the use can dismiss, or dismissed already.
udm_fields_viewer_pinned_fields[]

string

Optional. A list of fields to pin at the top of the udm fields viewer.
search_preferences

object (SearchPreferences)

Optional. Search configuration preferences.

SearchHistory

A previously run Search Query.

JSON representation 
{
  "query": string,
  "time_range": {
    object (Interval)
  },
  "execution_time": string,
  "chronicle_owned": boolean,
  "natural_language_query": string,
  "display_name": string,
  "description": string,
  "search_save_time": string,
  "search_update_time": string,
  "raw_query": string,
  "placeholder_names": [
    string
  ],
  "placeholder_descriptions": [
    string
  ],
  "placeholder_values": [
    string
  ],
  "saved_search_resource": string,
  "saved_search_id": string,
  "sharing_mode": enum (SharingMode),
  "query_type": enum (QueryType),
  "case_insensitive": boolean,
  "operation": string,
  "relative_time_range": {
    object (RelativeTimeRange)
  }
}
Fields
query

string

Required. The UDM Search query that was executed.
time_range

object (Interval)

Optional. The time interval that the query is run over.
execution_time

string (Timestamp format)

Optional. The time the query was run.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted.Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
chronicle_owned

boolean

Optional. Whether the saved search used is based on a saved template owned by Chronicle.
natural_language_query

string

If applicable, the natural language query used to generate the UDM Search Query.
display_name

string

If applicable, the display name of the saved search used to generate this instance.
description

string

If applicable, the description of the saved search used to generate this instance.
search_save_time

string (Timestamp format)

Optional. If applicable, the created timestamp of the saved search used to generate this instance.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted.Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
search_update_time

string (Timestamp format)

Optional. If applicable, the updated timestamp of the saved search used to generate this instance.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted.Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
raw_query

string

Optional. If applicable, the UDM saved search string with unreplaced placeholder names, from the saved search query used to generate this instance, e.g. "principal.hostname = $placeholder1 and target.ip = $placeholder2".
placeholder_names[]

string

Optional. If applicable, the placeholder names from the saved search used to generate this instance, e.g. ["$placeholder1", "$placeholder2"].
placeholder_descriptions[]

string

Optional. If applicable, the placeholder descriptions from the saved search used to generate this instance, e.g. ["host", "ip"]. Each element's position corresponds to placeholder_names.
placeholder_values[]

string

Optional. If applicable, the placeholder values from the saved search to generate this instance, e.g. ["abu", "1.2.3.4"]. Each element's position corresponds to placeholder_names.
saved_search_resource

string

Optional. If applicable, the resource name of the saved search used to generate this instance. Format: projects/{project}/location/{location}/instances/{instance}/users/{user}/searchQueries/{queryid}
saved_search_id

string

Optional. If applicable, the id of the saved search used to generate this instance.
sharing_mode

enum (SharingMode)

Optional. If applicable, the sharing mode of the saved search used to generate this instance.
query_type

enum (QueryType)

Optional. The query type.
case_insensitive

boolean

Optional. If true, the search was performed in a case-insensitive manner.
operation

string

Optional. The name of the operation resource representing the UDM Search operation. This can be used to fetch stored results or stream the results of an in-progress operation.

Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}
relative_time_range

object (RelativeTimeRange)

Optional. Defines a time range relative to the start point of the query over which it is running.

RelativeTimeRange

Defines a time range relative to a reference point. Specifies the duration (time_span) and unit (time_unit) of the range.

JSON representation 
{
  "time_span": string,
  "time_unit": enum (TimeUnit)
}
Fields
time_span

string (int64 format)

Optional. Relative time value.
time_unit

enum (TimeUnit)

Optional. Relative time unit.

ColumnSet

A list of UDM columns with a unique name.

JSON representation 
{
  "label": string,
  "columns": [
    string
  ]
}
Fields
label

string

The name of the column set.
columns[]

string

The list of udm fields corresponding to columns.

DismissibleNotification

A notification that the user can dismiss.

JSON representation 
{
  "id": string,
  "dismissed_time": string
}
Fields
id

string

Required. Unique ID of the user notification. Any non-empty string is accepted. The UI will use a literal string to identify notifications used in certain places of the product. It is preferable to have user-friendly self-descripting strings (eg. "new-feature-popup").
dismissed_time

string (Timestamp format)

Optional. The time the notification was dismissed. The notification should considered dismissed when the time is prior to "now".

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted.Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

SearchPreferences

Collection of preferences for Search configuration.

JSON representation 
{
  "max_data_sample_count": integer,
  "data_sample_strategy": enum (DataSampleStrategy)
}
Fields
max_data_sample_count

integer

Optional. The maximum number of data samples to return.
data_sample_strategy

enum (DataSampleStrategy)

Optional. The data sample strategy to use for fetching search results.

DataSampleStrategy

The data sample strategy to use for fetching search results.

Enums
DATA_SAMPLE_STRATEGY_UNSPECIFIED No data sample strategy specified.
FAST_RETRIEVAL Return required number of results which are retrieved earlier and discard the rest.
MOST_FRESH Return the latest/newest required number of results and discard the rest.