Method: legacy.legacySearchDetections

Full name: projects.locations.instances.legacy.legacySearchDetections

Legacy endpoint for searching detections for a rule version.

HTTP request

GET https://chronicle.googleapis.com/v1alpha/{instance}/legacy:legacySearchDetections

Path parameters

Parameters
instance

string

Required. Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}

Query parameters

Parameters
ruleId

string

Required. The specific rule revision to search detections for. There are four acceptable formats: - {rule_id} retrieves detections for the latest revision of the Rule with rule ID |rule_id| - {rule_id}@{revision_id} retrieves detections for the Rule revision with rule ID |rule_id| and revision ID |revision_id|. - {rule_id}@{wildcard} retrieves detections for all revisions of the Rule with rule ID |rule_id|. - {wildcard} retrieves detections for all revisions of all Rules.
alertState

enum (AlertState)

Optional. An enum that filters which detections are returned by their AlertState.
startTime

string (Timestamp format)

Optional. The time to start search detections from, inclusive.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted.Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
endTime

string (Timestamp format)

Optional. The time to end searching detections to, exclusive.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted.Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
listBasis

enum (ListBasis)

Optional. Basis for determining whether to apply start_time and end_time filters for detection time or creation time of the detection.
pageSize

integer

Optional. Maximum number of detections to return.
pageToken

string

Optional. A page token, received from a previous LegacySearchDetections call. Provide this to retrieve the subsequent page.

When paginating, all other parameters provided to LegacySearchDetections must match the call that provided the page token.
maxRespSizeBytes

integer

Optional. The maximum size of response in bytes. If it is set to 0 (or is omitted), the server will not enforce any max response size limit.
includeNestedDetections

boolean

Optional. If true, include one level of nested detections in the response.

Request body

The request body must be empty.

Response body

LegacySearchDetections response message.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "detections": [
    {
      object (Collection)
    }
  ],
  "nested_detection_samples": [
    {
      object (DetectionWithSamples)
    }
  ],
  "next_page_token": string,
  "resp_too_large_detections_truncated": boolean
}
Fields
detections[]

object (Collection)

Either detections or nested_detections will be populated, but not both. List of detections in Collection protos corresponding to the rule_id. Only returned if include_nested_detections is false or missing in the request.
nested_detection_samples[]

object (DetectionWithSamples)

Detections generated by the rule named by rule_id in the request, along with one level of nested detections. Only returned if include_nested_detections is true in the request.
next_page_token

string

A token that can be sent as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.
resp_too_large_detections_truncated

boolean

This is related to the max_resp_size_bytes field in the request. If the original response size is larger than the max_resp_size_bytes, we will truncate detections so that the response size is smaller than max_resp_size_bytes, and this field will be set to true.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the instance resource:

  • chronicle.legacies.legacySearchDetections

For more information, see the IAM documentation.

ListBasis

Type of Timestamp to use for listing detections.

Enums
LIST_BASIS_UNSPECIFIED Unspecified list basis.
DETECTION_TIME List detections by detection time.
CREATED_TIME List detections by created time.