REST Resource: projects.locations.instances.feeds

Resource: Feed

Feed is a resource that contains feed information needed to create a feed.

JSON representation 
{
  "name": string,
  "displayName": string,
  "details": {
    object (FeedDetails)
  },
  "state": enum (State),
  "failureMsg": string,
  "readOnly": boolean,
  "lastFeedInitiationTime": string,
  "failureDetails": {
    object (FeedFailureDetails)
  }
}
Fields
name

string

The resource name of the feed. Format: projects/{project}/locations/{location}/instances/{instance}/feeds/{feed}
displayName

string

Customer-provided feed name.
details

object (FeedDetails)

Additional details of the feed, these details are dynamic and will be different for each of the feeds.
state

enum (State)

Output only. State of the feed.
failureMsg

string

Output only. Details about the most recent failure when feed state is FAILED.
readOnly

boolean

Output only. Whether this feed can be updated or deleted.
lastFeedInitiationTime

string (Timestamp format)

Output only. Latest timestamp when the transfer was successful for the feed.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
failureDetails

object (FeedFailureDetails)

Output only. Failure details for the feed. If the feed is in the failure state, this field will contain the details of the error cause and actions.

FeedDetails

Additional details of the feed, these details are dynamic and will be different for each of the feeds.

JSON representation 
{
  "feedSourceType": enum (FeedSourceType),
  "logType": string,
  "assetNamespace": string,
  "labels": {
    string: string,
    ...
  },
  "stsMigrationReadiness": enum (STSMigrationReadiness),

  // Union field details can be only one of the following:
  "anomaliSettings": {
    object (AnomaliIocSettings)
  },
  "azureAdContextSettings": {
    object (AzureADContextSettings)
  },
  "cloudPassageSettings": {
    object (CloudPassageSettings)
  },
  "cortexXdrSettings": {
    object (CortexXDRSettings)
  },
  "duoAuthSettings": {
    object (DuoAuthSettings)
  },
  "duoUserContextSettings": {
    object (DuoUserContextSettings)
  },
  "microsoftGraphAlertSettings": {
    object (MicrosoftGraphAlertSettings)
  },
  "microsoftSecurityCenterAlertSettings": {
    object (MicrosoftSecurityCenterAlertSettings)
  },
  "mimecastMailSettings": {
    object (MimecastMailSettings)
  },
  "office365Settings": {
    object (Office365Settings)
  },
  "proofpointMailSettings": {
    object (ProofpointMailSettings)
  },
  "recordedFutureIocSettings": {
    object (RecordedFutureIocSettings)
  },
  "workdaySettings": {
    object (WorkdaySettings)
  },
  "panIocSettings": {
    object (PanIocSettings)
  },
  "oktaSettings": {
    object (OktaSettings)
  },
  "oktaUserContextSettings": {
    object (OktaUserContextSettings)
  },
  "foxItStixSettings": {
    object (FoxITStixSettings)
  },
  "threatConnectIocSettings": {
    object (ThreatConnectIoCSettings)
  },
  "serviceNowCmdbSettings": {
    object (ServiceNowCMDBSettings)
  },
  "impervaWafSettings": {
    object (ImpervaWAFSettings)
  },
  "thinkstCanarySettings": {
    object (ThinkstCanarySettings)
  },
  "rhIsacIocSettings": {
    object (RHIsacIocSettings)
  },
  "rapid7InsightSettings": {
    object (Rapid7InsightSettings)
  },
  "salesforceSettings": {
    object (SalesforceSettings)
  },
  "netskopeAlertSettings": {
    object (NetskopeAlertSettings)
  },
  "azureMdmIntuneSettings": {
    object (AzureMDMIntuneSettings)
  },
  "azureAdSettings": {
    object (AzureADSettings)
  },
  "proofpointOnDemandSettings": {
    object (ProofpointOnDemandSettings)
  },
  "workspaceUsersSettings": {
    object (WorkspaceUsersSettings)
  },
  "workspaceActivitySettings": {
    object (WorkspaceActivitySettings)
  },
  "workspaceAlertsSettings": {
    object (WorkspaceAlertsSettings)
  },
  "workspacePrivilegesSettings": {
    object (WorkspacePrivilegesSettings)
  },
  "workspaceMobileSettings": {
    object (WorkspaceMobileSettings)
  },
  "workspaceChromeOsSettings": {
    object (WorkspaceChromeOSSettings)
  },
  "workspaceGroupsSettings": {
    object (WorkspaceGroupsSettings)
  },
  "azureAdAuditSettings": {
    object (AzureADAuditSettings)
  },
  "symantecEventExportSettings": {
    object (SymantecEventExportSettings)
  },
  "qualysVmSettings": {
    object (QualysVMSettings)
  },
  "panPrismaCloudSettings": {
    object (PanPrismaCloudSettings)
  },
  "gcsSettings": {
    object (GoogleCloudStorageSettings)
  },
  "httpSettings": {
    object (HttpSettings)
  },
  "sftpSettings": {
    object (SftpSettings)
  },
  "amazonS3Settings": {
    object (AmazonS3Settings)
  },
  "azureBlobStoreSettings": {
    object (AzureBlobStoreSettings)
  },
  "amazonSqsSettings": {
    object (AmazonSQSSettings)
  },
  "googleCloudIdentityDevicesSettings": {
    object (GoogleCloudIdentityDevicesSettings)
  },
  "googleCloudIdentityDeviceUsersSettings": {
    object (GoogleCloudIdentityDeviceUsersSettings)
  },
  "crowdstrikeDetectsSettings": {
    object (CrowdStrikeDetectsSettings)
  },
  "mandiantIocSettings": {
    object (MandiantIoCSettings)
  },
  "sentineloneAlertSettings": {
    object (SentineloneAlertSettings)
  },
  "qualysScanSettings": {
    object (QualysScanSettings)
  },
  "pubsubSettings": {
    object (PubsubSettings)
  },
  "amazonKinesisFirehoseSettings": {
    object (AmazonKinesisFirehoseSettings)
  },
  "webhookSettings": {
    object (WebhookSettings)
  },
  "dummyLogTypeSettings": {
    object (DummyLogTypeSettings)
  },
  "httpsPushGoogleCloudPubsubSettings": {
    object (HttpsPushGoogleCloudPubSubSettings)
  },
  "httpsPushAmazonKinesisFirehoseSettings": {
    object (HttpsPushAmazonKinesisFirehoseSettings)
  },
  "httpsPushWebhookSettings": {
    object (HttpsPushWebhookSettings)
  },
  "awsEc2HostsSettings": {
    object (AWSEC2HostsSettings)
  },
  "awsEc2InstancesSettings": {
    object (AWSEC2InstancesSettings)
  },
  "awsEc2VpcsSettings": {
    object (AWSEC2VpcsSettings)
  },
  "awsIamSettings": {
    object (AWSIAMSettings)
  },
  "netskopeAlertV2Settings": {
    object (NetskopeAlertV2Settings)
  },
  "gcsV2Settings": {
    object (GoogleCloudStorageV2Settings)
  },
  "amazonS3V2Settings": {
    object (AmazonS3V2Settings)
  },
  "amazonSqsV2Settings": {
    object (AmazonSQSV2Settings)
  },
  "azureEventHubSettings": {
    object (AzureEventHubSettings)
  },
  "trellixHxHostsSettings": {
    object (TrellixHxHostsSettings)
  },
  "azureBlobStoreV2Settings": {
    object (AzureBlobStoreV2Settings)
  },
  "trellixHxAlertsSettings": {
    object (TrellixHxAlertsSettings)
  },
  "googleCloudStorageEventDrivenSettings": {
    object (GoogleCloudStorageEventDrivenSettings)
  },
  "crowdstrikeAlertsSettings": {
    object (CrowdStrikeAlertsSettings)
  },
  "trellixHxBulkAcqsSettings": {
    object (TrellixHxBulkAcqsSettings)
  },
  "mimecastMailV2Settings": {
    object (MimecastMailV2Settings)
  }
  // End of list of possible types for union field details.
}
Fields
feedSourceType

enum (FeedSourceType)

Source Type of the feed.
logType

string

LogType. Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{logType}
assetNamespace

string

The asset namespace to apply to all logs ingested through this feed.
labels

map (key: string, value: string)

The ingestion metadata labels to apply to all logs ingested through this feed, and the resulting normalized data.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
stsMigrationReadiness

enum (STSMigrationReadiness)

Optional. The status of the feed's migration to STS.
Union field details. Additional details of the feed. Depends on the feed type. details can be only one of the following:
anomaliSettings

object (AnomaliIocSettings)

Anomali IOC settings.
azureAdContextSettings

object (AzureADContextSettings)

Azure AD Context settings.
cloudPassageSettings

object (CloudPassageSettings)

Cloud Passage settings.
cortexXdrSettings

object (CortexXDRSettings)

Cortex XDR settings.
duoAuthSettings

object (DuoAuthSettings)

Duo Auth settings.
duoUserContextSettings

object (DuoUserContextSettings)

Duo User Context settings.
microsoftGraphAlertSettings

object (MicrosoftGraphAlertSettings)

Microsoft Graph Alert settings.
microsoftSecurityCenterAlertSettings

object (MicrosoftSecurityCenterAlertSettings)

Microsoft Security center alert settings.
mimecastMailSettings

object (MimecastMailSettings)

Mimecast mail settings.
office365Settings

object (Office365Settings)

Office 365 settings.
proofpointMailSettings

object (ProofpointMailSettings)

Proofpoint mail settings.
recordedFutureIocSettings

object (RecordedFutureIocSettings)

Recorded Future IOC settings.
workdaySettings

object (WorkdaySettings)

Workday settings.
panIocSettings

object (PanIocSettings)

PAN IOC settings.
oktaSettings

object (OktaSettings)

Okta settings.
oktaUserContextSettings

object (OktaUserContextSettings)

Okta user context settings.
foxItStixSettings

object (FoxITStixSettings)

Fox-IT STIX settings.
threatConnectIocSettings

object (ThreatConnectIoCSettings)

ThreatConnect IOC settings.
serviceNowCmdbSettings

object (ServiceNowCMDBSettings)

ServiceNow CMDB settings.
impervaWafSettings

object (ImpervaWAFSettings)

Imperva WAF settings.
thinkstCanarySettings

object (ThinkstCanarySettings)

Thinkst Canary settings.
rhIsacIocSettings

object (RHIsacIocSettings)

RH-ISAC IOC settings.
rapid7InsightSettings

object (Rapid7InsightSettings)

Rapid7 Insight settings.
salesforceSettings

object (SalesforceSettings)

Salesforce settings.
netskopeAlertSettings

object (NetskopeAlertSettings)

Netskope alert settings.
azureMdmIntuneSettings

object (AzureMDMIntuneSettings)

Azure MDM Intune settings.
azureAdSettings

object (AzureADSettings)

Azure AD settings.
proofpointOnDemandSettings

object (ProofpointOnDemandSettings)

Proofpoint On-Demand settings.
workspaceUsersSettings

object (WorkspaceUsersSettings)

Workspace users settings.
workspaceActivitySettings

object (WorkspaceActivitySettings)

Workspace activity settings.
workspaceAlertsSettings

object (WorkspaceAlertsSettings)

Workspace alerts settings.
workspacePrivilegesSettings

object (WorkspacePrivilegesSettings)

Workspace privileges settings.
workspaceMobileSettings

object (WorkspaceMobileSettings)

Workspace mobile settings.
workspaceChromeOsSettings

object (WorkspaceChromeOSSettings)

Workspace ChromeOS settings.
workspaceGroupsSettings

object (WorkspaceGroupsSettings)

Workspace Groups settings.
azureAdAuditSettings

object (AzureADAuditSettings)

Azure AD Audit settings.
symantecEventExportSettings

object (SymantecEventExportSettings)

Symantec Event Export settings.
qualysVmSettings

object (QualysVMSettings)

Qualys VM settings
panPrismaCloudSettings

object (PanPrismaCloudSettings)

PAN Prisma Cloud settings.
gcsSettings

object (GoogleCloudStorageSettings)

Google Cloud Storage settings.
httpSettings

object (HttpSettings)

HTTP settings.
sftpSettings

object (SftpSettings)

SFTP settings.
amazonS3Settings

object (AmazonS3Settings)

Amazon S3 settings.
azureBlobStoreSettings

object (AzureBlobStoreSettings)

Azure Blob Storage settings.
amazonSqsSettings

object (AmazonSQSSettings)

Amazon SQS settings.
googleCloudIdentityDevicesSettings

object (GoogleCloudIdentityDevicesSettings)

Google Cloud Identity Devices settings.
googleCloudIdentityDeviceUsersSettings

object (GoogleCloudIdentityDeviceUsersSettings)

Google Cloud Identity Device Users settings.
crowdstrikeDetectsSettings

object (CrowdStrikeDetectsSettings)

CrowdStrike Detects API settings.
mandiantIocSettings

object (MandiantIoCSettings)

Mandiant IOC settings.
sentineloneAlertSettings

object (SentineloneAlertSettings)

SentinelOne Alert settings.
qualysScanSettings

object (QualysScanSettings)

Qualys Scan Settings
pubsubSettings

object (PubsubSettings)

Pub/Sub settings.
amazonKinesisFirehoseSettings

object (AmazonKinesisFirehoseSettings)

Amazon Kinesis Firehose settings.
webhookSettings

object (WebhookSettings)

Webhook settings.
dummyLogTypeSettings

object (DummyLogTypeSettings)

DummyLogType Settings.
httpsPushGoogleCloudPubsubSettings

object (HttpsPushGoogleCloudPubSubSettings)

Https push Google Pub/Sub settings.
httpsPushAmazonKinesisFirehoseSettings

object (HttpsPushAmazonKinesisFirehoseSettings)

Https push Amazon Kinesis Firehose settings.
httpsPushWebhookSettings

object (HttpsPushWebhookSettings)

Https push Webhook settings.
awsEc2HostsSettings

object (AWSEC2HostsSettings)

AWS EC2 Hosts settings.
awsEc2InstancesSettings

object (AWSEC2InstancesSettings)

AWS EC2 Instances settings.
awsEc2VpcsSettings

object (AWSEC2VpcsSettings)

AWS EC2 Vpcs settings.
awsIamSettings

object (AWSIAMSettings)

AWS IAM settings.
netskopeAlertV2Settings

object (NetskopeAlertV2Settings)

Netskope alert V2 settings.
gcsV2Settings

object (GoogleCloudStorageV2Settings)

Settings for Google Cloud Storage Omniflow feeds.
amazonS3V2Settings

object (AmazonS3V2Settings)

Settings for S3 Omniflow feeds.
amazonSqsV2Settings

object (AmazonSQSV2Settings)

Settings for SQS Omniflow feeds.
azureEventHubSettings

object (AzureEventHubSettings)

Settings for Omniflow based native ingestion from azure event hub.
trellixHxHostsSettings

object (TrellixHxHostsSettings)

Settings for Trellix HX Host Metadata.
azureBlobStoreV2Settings

object (AzureBlobStoreV2Settings)

Settings for Azure Blobstore Omniflow feeds.
trellixHxAlertsSettings

object (TrellixHxAlertsSettings)

Settings for Trellix HX Alerts Metadata.
googleCloudStorageEventDrivenSettings

object (GoogleCloudStorageEventDrivenSettings)

Settings for Omniflow based Google Cloud Storage event driven feeds.
crowdstrikeAlertsSettings

object (CrowdStrikeAlertsSettings)

CrowdStrike Alerts API settings.
trellixHxBulkAcqsSettings

object (TrellixHxBulkAcqsSettings)

Settings for Trellix HX Bulk Acquisitions Metadata.
mimecastMailV2Settings

object (MimecastMailV2Settings)

Required. Mimecast mail v2 settings.

AnomaliIocSettings

Anomali IOC settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  }
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.

UsernameSecretAuth

Info for username and secret based authentication.

JSON representation 
{
  "user": string,
  "secret": string
}
Fields
user

string

Username of an identity used for authentication.
secret

string

Secret of the account identified by userName.

AzureADContextSettings

Azure AD Context settings.

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "retrieveDevices": boolean,
  "retrieveGroups": boolean,
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
retrieveDevices

boolean

Whether to retrieve device information in user context.
retrieveGroups

boolean

Whether to retrieve group information in user context.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

MicrosoftOAuthClientCredentials

Microsoft OAuth 2.0 client credentials grant.

JSON representation 
{
  "clientId": string,
  "clientSecret": string
}
Fields
clientId

string

Client ID.
clientSecret

string

Client secret.

CloudPassageSettings

CloudPassage settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "eventTypes": [
    string
  ]
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
eventTypes[]

string

Event types filter for the events API.

CortexXDRSettings

PAN Cortex XDR settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string,
  "endpoint": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.
endpoint

string

API Endpoint.

HttpHeaderAuth

HTTP header based authentication.

JSON representation 
{
  "headerKeyValues": [
    {
      object (HeaderKeyValue)
    }
  ]
}
Fields
headerKeyValues[]

object (HeaderKeyValue)

Header key-value pairs.

HeaderKeyValue

Header key-value pairs.

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string

Key.
value

string

Value.

DuoAuthSettings

Duo Authentication settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
hostname

string

API Hostname.

DuoUserContextSettings

Duo User Context settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
hostname

string

API hostname.

MicrosoftGraphAlertSettings

Microsoft Graph Alert settings.

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

MicrosoftSecurityCenterAlertSettings

Microsoft Security Center alert settings.

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "subscriptionId": string,
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
subscriptionId

string

Subscription ID of the Microsoft security center alert settings alert.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

MimecastMailSettings

Mimecast Mail settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.

Office365Settings

Office 365 settings.

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "tenantId": string,
  "contentType": enum (ContentType),
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
tenantId

string

Tenant ID.
contentType

enum (ContentType)

Supported office 365 content type.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

ContentType

Office 365 supported content types: https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference#working-with-the-office-365-management-activity-api

Enums
CONTENT_TYPE_UNSPECIFIED Unspecified content type.
AUDIT_AZURE_ACTIVE_DIRECTORY Audit.AzureActiveDirectory.
AUDIT_EXCHANGE Audit.Exchange.
AUDIT_SHARE_POINT Audit.SharePoint.
AUDIT_GENERAL Audit.General.
DLP_ALL DLP.All.

ProofpointMailSettings

Proofpoint Mail settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  }
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.

RecordedFutureIocSettings

Recorded Future IOC settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  }
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.

WorkdaySettings

Workday settings.

JSON representation 
{
  "authentication": {
    object (WorkdayAuth)
  },
  "hostname": string,
  "tenantId": string
}
Fields
authentication

object (WorkdayAuth)

Input only. Authentication.
hostname

string

API Hostname.
tenantId

string

Tenant ID.

WorkdayAuth

Authentication for Workday.

JSON representation 
{
  "user": string,
  "secret": string,
  "tokenEndpoint": string,
  "clientId": string,
  "clientSecret": string,
  "refreshToken": string
}
Fields
user

string

Username. This is unused: Workday feeds were originally configured using a username and secret authentication method, but only the secret field was used, and it was used to supply the OAuth access token.
secret

string

The access token used to authenticate against Workday. This field is called "secret" to maintain backwards compatibility. Workday was (only) configured using username (which was unused) and secret (which is used as the access token). Either this field or all of the other OAuth fields below must be specified.
tokenEndpoint

string

Token endpoint to get the OAuth token from.
clientId

string

Client ID.
clientSecret

string

Client Secret.
refreshToken

string

Refresh Token.

PanIocSettings

PAN IOC settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "feedId": string,
  "feed": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
feedId

string

PAN IOC feed ID.
feed

string

PAN IOC feed name.

OktaSettings

Okta settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.

OktaUserContextSettings

Okta user context settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string,
  "managerIdReferenceField": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.
managerIdReferenceField

string

Manager id reference field.

FoxITStixSettings

Fox-IT STIX settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "ssl": {
    object (SSLClientKeypair)
  },
  "pollServiceUri": string,
  "collection": string
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
ssl

object (SSLClientKeypair)

SSL client key pair.
pollServiceUri

string

TAXII poll service URI.
collection

string

Collection available at the poll service.

SSLClientKeypair

An SSL client certificate keypair.

JSON representation 
{
  "encodedPrivateKey": string,
  "sslCertificate": string
}
Fields
encodedPrivateKey

string

The encoded private key. The string should be a private key in PEM format, and should include the begin header and end footer lines. It may also include newlines.

Example: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,F23074E02CF47304

-----END RSA PRIVATE KEY-----
sslCertificate

string

The encoded SSL certificate. The string should be an SSL certificate in PEM format, and should include the begin header and end footer lines. It may also include newlines.

Example: -----BEGIN CERTIFICATE----- -----END CERTIFICATE-----

ThreatConnectIoCSettings

ThreatConnect IOC Settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string,
  "owners": [
    string
  ]
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
hostname

string

API Hostname.
owners[]

string

Owners.

ServiceNowCMDBSettings

ServiceNow CMDB settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string,
  "feedname": string
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
hostname

string

API Hostname.
feedname

string

Feedname.

ImpervaWAFSettings

Imperva WAF settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  }
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.

ThinkstCanarySettings

Thinkst Canary settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.

RHIsacIocSettings

RH-ISAC settings.

JSON representation 
{
  "authentication": {
    object (OAuthClientCredentials)
  }
}
Fields
authentication

object (OAuthClientCredentials)

Input only. Authentication.

OAuthClientCredentials

OAuth 2.0 client credentials grant. See https://tools.ietf.org/html/rfc6749.

JSON representation 
{
  "tokenEndpoint": string,
  "clientId": string,
  "clientSecret": string
}
Fields
tokenEndpoint

string

Token endpoint.
clientId

string

Client ID.
clientSecret

string

Client secret.

Rapid7InsightSettings

Rapid7 Insight settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "endpoint": string,
  "hostname": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
endpoint

string

Rapid7 API endpoint. Should be "vulnerabilities" or "assets".
hostname

string

API Hostname.

SalesforceSettings

Salesforce settings.

JSON representation 
{
  "hostname": string,

  // Union field authentication can be only one of the following:
  "oauthPasswordGrantAuth": {
    object (OAuthPasswordGrantCredentials)
  },
  "oauthJwtCredentials": {
    object (OAuthJWTCredentials)
  }
  // End of list of possible types for union field authentication.
}
Fields
hostname

string

API hostname.
Union field authentication. Possible types of authentication. authentication can be only one of the following:
oauthPasswordGrantAuth

object (OAuthPasswordGrantCredentials)

Input only. OAuthPasswordGrantCredentials auth.
oauthJwtCredentials

object (OAuthJWTCredentials)

Input only. OAuthJWTCredentials auth.

OAuthPasswordGrantCredentials

OAuth 2.0 password grant. See https://tools.ietf.org/html/rfc6749.

JSON representation 
{
  "tokenEndpoint": string,
  "clientId": string,
  "clientSecret": string,
  "user": string,
  "password": string
}
Fields
tokenEndpoint

string

Token endpoint to get the OAuth token from.
clientId

string

Client ID.
clientSecret

string

Client secret.
user

string

Username.
password

string

Password.

OAuthJWTCredentials

OAuth 2.0 JWT grant. See, https://tools.ietf.org/html/rfc7519

JSON representation 
{
  "tokenEndpoint": string,
  "claims": {
    object (Claims)
  },

  // Union field credentials can be only one of the following:
  "rsCredentials": {
    object (RSCredentials)
  }
  // End of list of possible types for union field credentials.
}
Fields
tokenEndpoint

string

Token endpoint to get the OAuth token from.
claims

object (Claims)

Claims.
Union field credentials. Credentials. credentials can be only one of the following:
rsCredentials

object (RSCredentials)

RS credentials.

RSCredentials

RS credentials.

JSON representation 
{
  "privateKey": string
}
Fields
privateKey

string

Private key in PEM format.

Claims

Claims identifying a specific customer.

JSON representation 
{
  "issuer": string,
  "subject": string,
  "audience": string
}
Fields
issuer

string

Issuer. Usually the clientId.
subject

string

Subject. Usually the email.
audience

string

Audience.

NetskopeAlertSettings

Netskope Alert settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string,
  "feedname": string,
  "contentType": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.
feedname

string

Feedname.
contentType

string

Content type.

AzureMDMIntuneSettings

Azure MDM Intune settings.

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

AzureADSettings

Azure AD settings.

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

ProofpointOnDemandSettings

Proofpoint On-demand settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "clusterId": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
clusterId

string

Cluster ID.

WorkspaceUsersSettings

Workspace Users settings.

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

WorkspaceActivitySettings

Workspace Activity settings.

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string,
  "applications": [
    string
  ]
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.
applications[]

string

Applications.

WorkspaceAlertsSettings

Workspace Alert settings.

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

WorkspacePrivilegesSettings

Workspace Privileges settings.

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

WorkspaceMobileSettings

Workspace Mobile settings.

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

WorkspaceChromeOSSettings

Workspace Chrome OS settings.

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

WorkspaceGroupsSettings

Workspace Groups settings.

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

AzureADAuditSettings

Azure AD Audit settings.

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

SymantecEventExportSettings

Symantec Event Export settings.

JSON representation 
{
  "authentication": {
    object (OAuthRefreshToken)
  }
}
Fields
authentication

object (OAuthRefreshToken)

Input only. Authentication.

OAuthRefreshToken

OAuth 2.0 refresh token grant. See https://tools.ietf.org/html/rfc6749.

JSON representation 
{
  "tokenEndpoint": string,
  "clientId": string,
  "clientSecret": string,
  "refreshToken": string
}
Fields
tokenEndpoint

string

Token endpoint to get the OAuth token from.
clientId

string

Client ID.
clientSecret

string

Client secret.
refreshToken

string

Refresh token.

QualysVMSettings

Qualys VM settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
hostname

string

API Hostname.

PanPrismaCloudSettings

PAN Prisma Cloud settings.

JSON representation 
{
  "authentication": {
    object (PanPrismaAuth)
  },
  "hostname": string
}
Fields
authentication

object (PanPrismaAuth)

Input only. Authentication.
hostname

string

API Hostname.

PanPrismaAuth

PAN Prisma Cloud auth.

JSON representation 
{
  "user": string,
  "password": string
}
Fields
user

string

Username.
password

string

Password.

GoogleCloudStorageSettings

Google Cloud Storage settings.

JSON representation 
{
  "bucketUri": string,
  "sourceType": enum (URISourceType),
  "sourceDeletionOption": enum (SourceDeletionOption),
  "chronicleServiceAccount": string
}
Fields
bucketUri

string

Bucket URI.
sourceType

enum (URISourceType)

The URI source type.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.
chronicleServiceAccount

string

Output only. Service Account Chronicle will be using to pull data.

URISourceType

The type of URIs specified in the source URIs.

Enums
URI_SOURCE_TYPE_UNSPECIFIED If encountered, will throw an INVALID_ARGUMENT error.
FILES The type of files pointed to by source_uris are files.
FOLDERS The type of files pointed to by source_uris are folders and Xenon should not descend into subfolders of those folders.
FOLDERS_RECURSIVE The type of files pointed to by source_uris are folders and Xenon should descend into subfolders of those folders.

SourceDeletionOption

Source deletion option controls whether source files should be deleted after transferring.

Enums
SOURCE_DELETION_OPTION_UNSPECIFIED If encountered, will be treated as SOURCE_DELETION_NEVER.
SOURCE_DELETION_NEVER Never delete files from the source.
SOURCE_DELETION_ON_SUCCESS After the fetch completes, if there are no errors, delete files and any directories made empty by the file deletion from the source.
SOURCE_DELETION_ON_SUCCESS_FILES_ONLY After the fetch completes, if there are no errors, delete files (leaving any directories) from the source.

HttpSettings

HTTP settings.

JSON representation 
{
  "uri": string,
  "sourceType": enum (URISourceType),
  "sourceDeletionOption": enum (SourceDeletionOption)
}
Fields
uri

string

HTTP URI.
sourceType

enum (URISourceType)

The URI source type.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.

SftpSettings

SFTP settings.

JSON representation 
{
  "authentication": {
    object (SftpAuth)
  },
  "uri": string,
  "sourceType": enum (URISourceType),
  "sourceDeletionOption": enum (SourceDeletionOption)
}
Fields
authentication

object (SftpAuth)

Input only. Authentication.
uri

string

SFTP URI.
sourceType

enum (URISourceType)

The URI source type.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.

SftpAuth

SFTP Auth.

JSON representation 
{
  "username": string,
  "password": string,
  "privateKey": string,
  "privateKeyPassphrase": string
}
Fields
username

string

Username. Used for username and password authentication.
password

string

Password. Used for username and password authentication.
privateKey

string

Private key. Used for private key authentication.
privateKeyPassphrase

string

Private key passphrase. Used for private key authentication.

AmazonS3Settings

Amazon S3 settings.

JSON representation 
{
  "authentication": {
    object (S3Auth)
  },
  "s3Uri": string,
  "sourceType": enum (URISourceType),
  "sourceDeletionOption": enum (SourceDeletionOption)
}
Fields
authentication

object (S3Auth)

Input only. Authentication.
s3Uri

string

S3 URI.
sourceType

enum (URISourceType)

The URI source type.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.

S3Auth

Amazon S3 auth.

JSON representation 
{
  "accessKeyId": string,
  "secretAccessKey": string,
  "clientId": string,
  "clientSecret": string,
  "refreshUri": string,
  "region": enum (S3Region)
}
Fields
accessKeyId

string

Access key ID. Used when using access key auth.
secretAccessKey

string

Secret access key. Used when using access key auth.
clientId

string

Client ID. Used when using OAuth auth.
clientSecret

string

Client secret. Used when using OAuth auth.
refreshUri

string

Refresh URI. Used when using OAuth auth.
region

enum (S3Region)

S3 Region.

S3Region

AWS S3 regions: https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region.

Enums
S3_REGION_UNSPECIFIED Unspecified region means Auto detect. Auto detect does not successfully detect GOV Cloud.
US_EAST_1 US. N. Virginia (previously known as US_STANDARD).
US_EAST_2 Ohio.
US_WEST_1 N. California.
US_WEST_2 Oregon.
US_GOV_CLOUD Not accessible unless AWS US Govt. account.
US_GOV_EAST_1 Not accessible unless AWS US Govt. account.
EU_WEST_1 Europe. Ireland.
EU_WEST_2 London.
EU_WEST_3 Paris.
EU_CENTRAL_1 Frankfurt.
EU_NORTH_1 Stockholm.
EU_SOUTH_1 Milan.
AP_SOUTH_1 Asia Pacific Mumbai.
AP_SOUTHEAST_1 Singapore.
AP_SOUTHEAST_2 Sydney.
AP_SOUTHEAST_3 Jakarta.
AP_NORTHEAST_1 Tokyo.
AP_NORTHEAST_2 Seoul.
AP_NORTHEAST_3 Osaka.
AP_EAST_1 Hong Kong.
SA_EAST_1 South America. Sao Paulo.
CN_NORTH_1 China - Not accessible unless AWS China account. China - Beijing.
CN_NORTHWEST_1 China - Ningxia.
CA_CENTRAL_1 Canada. Canada Central.
AF_SOUTH_1 Africa. Capetown.
ME_SOUTH_1 Middle East. Bahrain.
AP_SOUTH_2 Asia Pacific (Hyderabad).
AP_SOUTHEAST_4 Asia Pacific (Melbourne).
CA_WEST_1 Canada West (Calgary).
EU_SOUTH_2 Europe (Spain).
EU_CENTRAL_2 Europe (Zurich).
IL_CENTRAL_1 Israel (Tel Aviv).
ME_CENTRAL_1 Middle East (UAE).

AzureBlobStoreSettings

Azure Blob Storage settings.

JSON representation 
{
  "authentication": {
    object (AzureAuth)
  },
  "azureUri": string,
  "sourceType": enum (URISourceType),
  "sourceDeletionOption": enum (SourceDeletionOption)
}
Fields
authentication

object (AzureAuth)

Input only. Authentication.
azureUri

string

Azure URI.
sourceType

enum (URISourceType)

The URI source type.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.

AzureAuth

Azure auth.

JSON representation 
{

  // Union field auth_type can be only one of the following:
  "sharedKey": string,
  "sasToken": string
  // End of list of possible types for union field auth_type.
}
Fields
Union field auth_type. Type of auth used with Azure. auth_type can be only one of the following:
sharedKey

string

Shared Key.
sasToken

string

SAS Token.

AmazonSQSSettings

Amazon SQS settings.

JSON representation 
{
  "region": enum (S3Region),
  "queue": string,
  "accountNumber": string,
  "authentication": {
    object (SQSAuth)
  },
  "sourceDeletionOption": enum (SourceDeletionOption)
}
Fields
region

enum (S3Region)

S3 Region.
queue

string

Name of the queue.
accountNumber

string

Account number of the owner of the queue.
authentication

object (SQSAuth)

Input only. Authentication.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.

SQSAuth

Amazon SQS auth.

JSON representation 
{
  "sqsAccessKeySecretAuth": {
    object (SQSAccessKeySecretAuth)
  },
  "additionalS3AccessKeySecretAuth": {
    object (AdditionalS3AccessKeySecretAuth)
  }
}
Fields
sqsAccessKeySecretAuth

object (SQSAccessKeySecretAuth)

SQS access key secret auth.
additionalS3AccessKeySecretAuth

object (AdditionalS3AccessKeySecretAuth)

Authentication for the S3 bucket referred to by the items in the SQS queue. This is only required if it is different from the authentication for the queue.

SQSAccessKeySecretAuth

Amazon SQS access key and secret auth.

JSON representation 
{
  "accessKeyId": string,
  "secretAccessKey": string
}
Fields
accessKeyId

string

Access key ID.
secretAccessKey

string

Secret access key.

AdditionalS3AccessKeySecretAuth

Additional S3 access key secret auth.

JSON representation 
{
  "accessKeyId": string,
  "secretAccessKey": string
}
Fields
accessKeyId

string

Access key ID.
secretAccessKey

string

Secret access key.

GoogleCloudIdentityDevicesSettings

Google Cloud Identity Devices settings.

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "apiVersion": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication
apiVersion

string

API Version

GoogleCloudIdentityDeviceUsersSettings

Google Cloud Identity Device Users settings.

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  }
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.

CrowdStrikeDetectsSettings

CrowdStrike Detects settings.

JSON representation 
{
  "authentication": {
    object (OAuthClientCredentials)
  },
  "hostname": string,
  "ingestionType": enum (IngestionType)
}
Fields
authentication

object (OAuthClientCredentials)

Input only. OAuthClientCredentials.
hostname

string

API Hostname.
ingestionType

enum (IngestionType)

Optional. Ingestion Type.

IngestionType

Ingestion Type.

Enums
INGESTION_TYPE_UNSPECIFIED For the feeds in which this field is not set
BRING_ONLY_NEW_DETECTIONS Ingests only new detections to be ingested.
BRING_ALL_DETECTIONS Ingests both new as well as old detections which are updated

MandiantIoCSettings

Mandiant IOC settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "startTime": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
startTime

string (Timestamp format)

time since when to start fetching the IOCs

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

SentineloneAlertSettings

SentinelOne Alert settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string,
  "initialStartTime": string,
  "isAlertApiSubscribed": boolean
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

Hostname of SentinelOne alert settings.
initialStartTime

string

initialStartTime from when to fetch the alerts
isAlertApiSubscribed

boolean

Is the customer subscribed to Alerts Api

QualysScanSettings

Qualys Scan settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string,
  "apiType": enum (ApiType)
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication
hostname

string

Hostname.
apiType

enum (ApiType)

Supported Qualys Scan api type.

ApiType

API Type

Enums
API_TYPE_UNSPECIFIED Unspecified API Type
SCAN_SUMMARY_OUTPUT Scan Summaries
SCAN_COMPLIANCE_OUTPUT Scan Compliance
SCAN_COMPLIANCE_CONTROL_OUTPUT Scan Compliance Control

PubsubSettings

Settings required by Google Cloud Pub/Sub Feeds(HTTP-Push).

JSON representation 
{
  "googleServiceAccountEmail": string
}
Fields
googleServiceAccountEmail

string

Google Service Account Email.

AmazonKinesisFirehoseSettings

This type has no fields.

Settings required by Amazon Kinesis Firehose Feeds(HTTP-Push).

WebhookSettings

This type has no fields.

Settings required by Webhook Feeds(HTTP-Push).

DummyLogTypeSettings

Settings required by Feeds of DummyLogType(used for testing purposes).

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "apiEndpoint": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
apiEndpoint

string

Full API Endpoint.

HttpsPushGoogleCloudPubSubSettings

Settings required by Google Cloud Platform Pub/Sub Feeds(HTTPS-Push V2).

JSON representation 
{
  "splitDelimiter": string
}
Fields
splitDelimiter

string

Optional. Delimiter to split on for the feed.

HttpsPushAmazonKinesisFirehoseSettings

Settings required by Amazon Kinesis Firehose Feeds(HTTPS-Push V2).

JSON representation 
{
  "splitDelimiter": string
}
Fields
splitDelimiter

string

Optional. Delimiter to split on for the feed.

HttpsPushWebhookSettings

Settings required by Webhook Feeds(HTTPS-Push V2).

JSON representation 
{
  "splitDelimiter": string
}
Fields
splitDelimiter

string

Optional. Delimiter to split on for the feed.

AWSEC2HostsSettings

AWS EC2 Hosts Settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  }
}
Fields
authentication

object (UsernameSecretAuth)

Input only. UsernameSecretAuth.

AWSEC2InstancesSettings

AWS EC2 Instances Settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  }
}
Fields
authentication

object (UsernameSecretAuth)

Input only. UsernameSecretAuth.

AWSEC2VpcsSettings

AWS EC2 Vpcs Settings.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  }
}
Fields
authentication

object (UsernameSecretAuth)

Input only. UsernameSecretAuth.

AWSIAMSettings

AWSIAMSettings contains details needed for creating an AWS IAM feed.

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "apiType": enum (ApiType)
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication
apiType

enum (ApiType)

Supported AWS IAM api type.

ApiType

API Type

Enums
API_TYPE_UNSPECIFIED API Type Unspecified
USERS Users.
ROLES Roles.
GROUPS Groups.

NetskopeAlertV2Settings

Netskope Alert V2 settings.

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string,
  "contentCategory": string,
  "contentTypes": [
    string
  ]
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.
contentCategory

string

Content Category.
contentTypes[]

string

Content type.

GoogleCloudStorageV2Settings

GoogleCloudStorageV2Settings is the settings proto for Omniflow Google Cloud Storage feeds. NEXT TAG: 5

JSON representation 
{
  "bucketUri": string,
  "sourceDeletionOption": enum (SourceDeletionOptionV2),
  "chronicleServiceAccount": string,
  "maxLookbackDays": integer
}
Fields
bucketUri

string

Required. Google Cloud Storage Bucket URI for the feed.
sourceDeletionOption

enum (SourceDeletionOptionV2)

Optional. Source deletion option determines if the data from the source is to be deleted after ingestion.
chronicleServiceAccount

string

Output only. SA that will read data, this is Storage Transfer Service SA of Customer's Tenancy Project.
maxLookbackDays

integer

Optional. Maximum File Age to ingest in days.

SourceDeletionOptionV2

Source deletion option determines whether source files should be deleted after transferring.

Enums
SOURCE_DELETION_OPTION_V2_UNSPECIFIED If encountered, will be treated as SOURCE_DELETION_NEVER.
NEVER Never delete files from the source.
ON_SUCCESS After the fetch completes, if there are no errors, delete files and any directories made empty by the file deletion from the source.

AmazonS3V2Settings

AmazonS3V2Settings is the settings proto for Omniflow S3 feeds. NEXT TAG: 6

JSON representation 
{
  "authentication": {
    object (S3AuthV2)
  },
  "s3Uri": string,
  "sourceDeletionOption": enum (SourceDeletionOptionV2),
  "maxLookbackDays": integer,
  "chronicleServiceAccount": string
}
Fields
authentication

object (S3AuthV2)

Required. Authentication.
s3Uri

string

Required. S3 URI.
sourceDeletionOption

enum (SourceDeletionOptionV2)

Optional. Source deletion option.
maxLookbackDays

integer

Optional. Maximum File Age to ingest in days.
chronicleServiceAccount

string

Output only. SA that will read data, this is Storage Transfer Service SA of Customer's Tenancy Project.

S3AuthV2

A message containing fields used to authenticate with Amazon S3.

JSON representation 
{

  // Union field auth_type can be only one of the following:
  "accessKeySecretAuth": {
    object (S3V2AccessKeySecretAuth)
  },
  "awsIamRoleAuth": {
    object (S3V2AwsIamRoleAuth)
  }
  // End of list of possible types for union field auth_type.
}
Fields
Union field auth_type. auth type for S3. auth_type can be only one of the following:
accessKeySecretAuth

object (S3V2AccessKeySecretAuth)

Access Key ID and Secret Access Key for an AWS account.
awsIamRoleAuth

object (S3V2AwsIamRoleAuth)

AWS IAM Role Auth for Identity Federation.

S3V2AccessKeySecretAuth

S3 V2 access key and secret auth.

JSON representation 
{
  "accessKeyId": string,
  "secretAccessKey": string
}
Fields
accessKeyId

string

Required. Access Key ID for an AWS account (a 20-character, alphanumeric string).
secretAccessKey

string

Required. Secret Access Key for an AWS account (a 40-character string).

S3V2AwsIamRoleAuth

AWS IAM Role Auth for S3 V2.

JSON representation 
{
  "awsIamRoleArn": string,
  "subjectId": string
}
Fields
awsIamRoleArn

string

AWS IAM Role for Identity Federation.
subjectId

string

Subject ID to use for S3.

AmazonSQSV2Settings

AmazonSQSV2Settings is the settings proto for Omniflow SQS feeds. NEXT TAG: 7

JSON representation 
{
  "queue": string,
  "s3Uri": string,
  "authentication": {
    object (SQSAuthV2)
  },
  "sourceDeletionOption": enum (SourceDeletionOptionV2),
  "maxLookbackDays": integer,
  "chronicleServiceAccount": string
}
Fields
queue

string

Required. Amazon Resource Name(ARN) of the queue.
s3Uri

string

Required. S3 URI.
authentication

object (SQSAuthV2)

Required. Authentication.
sourceDeletionOption

enum (SourceDeletionOptionV2)

Optional. Source deletion option.
maxLookbackDays

integer

Optional. Maximum File Age to ingest in days.
chronicleServiceAccount

string

Output only. SA that will read data, this is Storage Transfer Service SA of Customer's Tenancy Project.

SQSAuthV2

A message containing fields used to authenticate with Amazon SQS.

JSON representation 
{

  // Union field auth_type can be only one of the following:
  "sqsV2AccessKeySecretAuth": {
    object (SQSV2AccessKeySecretAuth)
  },
  "awsIamRoleAuth": {
    object (SQSV2AwsIamRoleAuth)
  }
  // End of list of possible types for union field auth_type.
}
Fields
Union field auth_type. auth tyoe for the SQS queue. auth_type can be only one of the following:
sqsV2AccessKeySecretAuth

object (SQSV2AccessKeySecretAuth)

Required. Auth key and secret for the SQS queue.
awsIamRoleAuth

object (SQSV2AwsIamRoleAuth)

Required. AWS IAM Role for Identity Federation.

SQSV2AccessKeySecretAuth

SQS V2 access key and secret auth.

JSON representation 
{
  "accessKeyId": string,
  "secretAccessKey": string
}
Fields
accessKeyId

string

Access key ID of the S3 bucket. Ex: AKIABCDEFGHIJKL.
secretAccessKey

string

Secret access key to access the S3 bucket.

SQSV2AwsIamRoleAuth

AWS IAM Role Auth for SQS V2.

JSON representation 
{
  "awsIamRoleArn": string,
  "subjectId": string
}
Fields
awsIamRoleArn

string

AWS IAM Role for Identity Federation.
subjectId

string

Subject ID to use for SQS.

AzureEventHubSettings

Settings required by Azure Event Hub Feeds.

JSON representation 
{
  "name": string,
  "consumerGroup": string,
  "eventHubConnectionString": string,
  "azureStorageConnectionString": string,
  "azureStorageContainer": string,
  "azureSasToken": string,
  "eventHubNamespace": string
}
Fields
name

string

Required. Event hub to read from.
consumerGroup

string

Required. Event hub consumer group to read from.
eventHubConnectionString

string

Required. Event hub connection string for authentication.
azureStorageConnectionString

string

Optional. Blob store connection string for authentication.
azureStorageContainer

string

Optional. Blob storage container name.
azureSasToken

string

Optional. SAS token
eventHubNamespace

string

Output only. Event hub namespace

TrellixHxHostsSettings

Settings required by Feeds of TrellixHxHosts.

JSON representation 
{
  "authentication": {
    object (TrellixStarXAuthentication)
  },
  "endpoint": string
}
Fields
authentication

object (TrellixStarXAuthentication)

Required. Authentication.
endpoint

string

Required. Trellix HX Device URL. This must be a valid URL with an http or https scheme. It has no default. Usually a device URL is in the form of either: https://xxx.trellix.com/hx/id// - or - https://htapdeviceproxy.md.mandiant.net/dphb/hx//

TrellixStarXAuthentication

TrellixStarXAuthentication contains a oneof with all of the authentication types supported by Trellix *X devices.

JSON representation 
{

  // Union field auth_type can be only one of the following:
  "msso": {
    object (MssoAuthentication)
  },
  "trellixIam": {
    object (TrellixIAMAuthentication)
  }
  // End of list of possible types for union field auth_type.
}
Fields
Union field auth_type. One of multiple potential auth types. auth_type can be only one of the following:
msso

object (MssoAuthentication)

Input only. MssoAuthentication auth type.
trellixIam

object (TrellixIAMAuthentication)

Input only. TrellixIAMAuthentication auth type.

MssoAuthentication

Info for MssoAuthentication using a username, password, and login api endpoint.

JSON representation 
{
  "username": string,
  "password": string,
  "apiEndpoint": string
}
Fields
username

string

Required. Username for MSSO authentication. There are no restrictions on the format of the username. It has no default, specifically enforced min / max length or character set. The username will have been provided by an MSSO administrator and it is assumed that they have provided a username that is internally consistent with MSSO authentication requirements / validation.
password

string

Required. Password of the account identified by username. There are no restrictions on the format of the password. It has no default, specifically enforced min / max length or character set. The password will have been provided by an MSSO administrator and it is assumed that they have provided a password that is internally consistent with MSSO authentication requirements / validation.
apiEndpoint

string

Required. The login api endpoint url. This must be a valid URL with an http or https scheme. It has no default.

TrellixIAMAuthentication

Settings for TrellixIAMAuthentication.

JSON representation 
{
  "clientId": string,
  "clientSecret": string,
  "scope": string
}
Fields
clientId

string

Required. Client ID generated in Trellix IAM. This is a unique identifier for the user that is generated in Trellix IAM. It has no default, specifically enforced min / max length or character set. It is assumed that the Client ID generated in Trellix IAM is internally consistent with Trellix IAM authentication requirements / validation.
clientSecret

string

Required. Secret associated with the Client ID. This is the secret generated in Trellix IAM for the Client ID. It has no default, specifically enforced min / max length or character set. It is assumed that the secret generated in Trellix IAM is internally consistent with Trellix IAM authentication requirements / validation.
scope

string

Required. OAUTH 2 scope to request for the authentication token. This is the OAUTH 2 scope to request for the authentication token. It has no default, specifically enforced min / max length or character set. It is assumed that the scope provided is internally consistent with Trellix IAM authentication requirements / validation.

AzureBlobStoreV2Settings

AzureBlobStoreV2Settings is the settings proto for Azure Blob Storage feeds. NEXT TAG: 7

JSON representation 
{
  "azureUri": string,
  "authentication": {
    object (AzureAuthV2)
  },
  "sourceDeletionOption": enum (SourceDeletionOptionV2),
  "maxLookbackDays": integer,
  "chronicleServiceAccount": string
}
Fields
azureUri

string

Required. Azure URI.
authentication

object (AzureAuthV2)

Required. Authentication.
sourceDeletionOption

enum (SourceDeletionOptionV2)

Optional. Source deletion option.
maxLookbackDays

integer

Optional. Maximum File Age to ingest in days.
chronicleServiceAccount

string

Output only. SA that will read data, this is Storage Transfer Service SA of Customer's Tenancy Project.

AzureAuthV2

A message containing fields used to authenticate with Azure Blob Storage.

JSON representation 
{

  // Union field auth_type can be only one of the following:
  "accessKey": string,
  "sasToken": string,
  "azureV2WorkloadIdentityFederation": {
    object (AzureV2WorkloadIdentityFederation)
  }
  // End of list of possible types for union field auth_type.
}
Fields
Union field auth_type. Possible types of authentication. auth_type can be only one of the following:
accessKey

string

Required. Access Key also known as shared key.
sasToken

string

Required. SAS Token.
azureV2WorkloadIdentityFederation

object (AzureV2WorkloadIdentityFederation)

Required. Azure V2 Workload Identity Federation.

AzureV2WorkloadIdentityFederation

Azure V2 Workload Identity Federation.

JSON representation 
{
  "clientId": string,
  "tenantId": string,
  "subjectId": string
}
Fields
clientId

string

Required. OAuth client ID.
tenantId

string

Required. Tenant ID.
subjectId

string

Required. Subject ID of the Azure subscription.

TrellixHxAlertsSettings

Settings required by Feeds of TrellixHxAlerts.

JSON representation 
{
  "authentication": {
    object (TrellixStarXAuthentication)
  },
  "endpoint": string
}
Fields
authentication

object (TrellixStarXAuthentication)

Required. Authentication.
endpoint

string

Required. Trellix HX Device URL. This must be a valid URL with an http or https scheme. It has no default. Usually a device URL is in the form of either: https://xxx.trellix.com/hx/id// - or - https://htapdeviceproxy.md.mandiant.net/dphb/hx//

GoogleCloudStorageEventDrivenSettings

GoogleCloudStorageEventDrivenSettings is the settings proto for Omniflow Google Cloud Storage feeds driven by pubsub events. NEXT TAG: 6

JSON representation 
{
  "bucketUri": string,
  "pubsubSubscription": string,
  "sourceDeletionOption": enum (SourceDeletionOptionV2),
  "chronicleServiceAccount": string,
  "maxLookbackDays": integer
}
Fields
bucketUri

string

Required. Google Cloud Storage Bucket URI for the feed.
pubsubSubscription

string

Required. Subscription name for pubsub topic.
sourceDeletionOption

enum (SourceDeletionOptionV2)

Optional. Source deletion option determines if the data from the source is to be deleted after ingestion.
chronicleServiceAccount

string

Output only. SA that will read data, this is Storage Transfer Service SA of Customer's Tenancy Project.
maxLookbackDays

integer

Optional. Maximum File Age to ingest in days.

CrowdStrikeAlertsSettings

CrowdStrike Alerts settings.

JSON representation 
{
  "authentication": {
    object (OAuthClientCredentials)
  },
  "hostname": string
}
Fields
authentication

object (OAuthClientCredentials)

Required. OAuthClientCredentials.
hostname

string

Required. API Hostname.

TrellixHxBulkAcqsSettings

Settings required by Feeds of TrellixHxBulkAcqs.

JSON representation 
{
  "authentication": {
    object (TrellixStarXAuthentication)
  },
  "endpoint": string
}
Fields
authentication

object (TrellixStarXAuthentication)

Required. Authentication.
endpoint

string

Required. Trellix HX Device URL. This must be a valid URL with an http or https scheme. It has no default. Usually a device URL is in the form of either: https://xxx.trellix.com/hx/id// - or - https://htapdeviceproxy.md.mandiant.net/dphb/hx//

MimecastMailV2Settings

Mimecast Mail V2 Settings.

JSON representation 
{
  "authCredentials": {
    object (MimecastV2OAuthClientCredentials)
  }
}
Fields
authCredentials

object (MimecastV2OAuthClientCredentials)

Required. Mimecast OAuthClientCredentials.

MimecastV2OAuthClientCredentials

OAuth 2.0 client credentials grant. See https://tools.ietf.org/html/rfc6749. NEXT TAG: 3

JSON representation 
{
  "clientId": string,
  "clientSecret": string
}
Fields
clientId

string

Required. Client ID.
clientSecret

string

Required. Client Secret.

STSMigrationReadiness

Whether the feed is ready for STS migration.

Enums
STS_MIGRATION_READINESS_UNSPECIFIED Default value. This value is unused.
NOT_READY The feed needs some work for STS migration.
READY The feed is ready for STS migration.
AUTH_RECONFIG_REQUIRED Need to recreate feed with updated auth.

State

List of states a feed can have.

Enums
STATE_UNSPECIFIED Unspecified feed state.
ACTIVE Feed is configured and ready to ingest data. Newly created feeds have this state. Once ingestion begins the feed will transition out of this state and will not transition back.
INACTIVE Feed is Disabled. When a user disables a feed it will transition to this state regardless of its current state. Once enabled a feed will transition to its previous state.
RUNNING Feed is enabled and currently ingesting data. A feed will transition to this state from an ACTIVE or COMPLETED state when Chronicle has begun fetching data for this feed.
SUCCEEDED Feed is enabled and has recently successfully ingested data. A feed will transition to this state from RUNNING or FAILED once a fetch has completed successfully.
FAILED Feed is enabled, but has recently failed to ingest data. A feed will transition to this state only from RUNNING once a fetch has failed. It will remain in this state until a subsequent fetch has succeeded.

FeedFailureDetails

FeedFailureDetails contains details about the errors thrown by chronicle for the feeds. These are user visible details. These details help user identify the root cause and take appropriate action for the feed errors. NEXT TAG: 5

JSON representation 
{
  "errorCode": string,
  "httpErrorCode": integer,
  "errorCause": string,
  "errorAction": string
}
Fields
errorCode

string

Output only. errorCode contains the error code for the feed. The field is populated for the feeds with failed status.
httpErrorCode

integer

Output only. httpErrorCode contains the HTTP error code for the feed failure. feed transfer failure may or may not result in http error code.
errorCause

string

Output only. errorCause contains the information regarding the failure cause.
errorAction

string

Output only. errorAction contains the user action prescribed for remediation of feed error.

Methods

create

 Creates a feed.

delete

 Deletes a feed.

disable

 Disable feed for ingestion.

enable

 Enable feed for ingestion.

generateSecret

 Generates a new secret for https push feeds which do not support jwt tokens.

get

 Gets a feed.

importPushLogs

 Import logs coming from https push feeds.

list

 Lists all feeds for the customer.

patch

 Updates the full feed.

scheduleTransfer

 Schedules a feed transfer for the feed.