REST Resource: projects.locations.instances.findingsRefinements

Resource: FindingsRefinement

Represents a set of logic conditions used to refine various types of findings such as curated rule detections.

JSON representation 
{
  "name": string,
  "displayName": string,
  "type": enum (FindingsRefinementType),
  "createTime": string,
  "updateTime": string,
  "query": string
}
Fields
name

string

Full resource name for the findings refinement. Format: projects/{project}/locations/{region}/instances/{instance}/findingsRefinements/{findingsRefinement}
displayName

string

Display name of the findings refinement.
type

enum (FindingsRefinementType)

The type of findings refinement.
createTime

string (Timestamp format)

Output only. The timestamp of when the findings refinement was created.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime

string (Timestamp format)

Output only. The timestamp of when the findings refinement was last updated.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
query

string

The query for the findings refinement. Works in conjunction with the type field to determine the findings refinement behavior. The syntax of this query is the same as a UDM search string. See the following for more information: https://cloud.google.com/chronicle/docs/investigation/udm-search

FindingsRefinementType

The type of findings refinement, which determines what the findings refinement runs over and the mechanism by which it runs.

Enums
FINDINGS_REFINEMENT_TYPE_UNSPECIFIED The findings refinement type is unspecified.
DETECTION_EXCLUSION Indicates that the findings refinement is a detection exclusion and should exclude matching detections.

Methods

computeFindingsRefinementActivity

 Returns findings refinement activity for a specific findings refinement.

create

 Creates a new findings refinement.

get

 Gets a single findings refinement.

getDeployment

 Gets a findings refinement deployment.

list

 Lists a collection of findings refinements.

patch

 Updates a findings refinement.

updateDeployment

 Updates a findings refinement deployment.