UDM user events and aliased asset events for the requested user and time range. If useUdm in request is false, we will include only asset events in this field and put user SDM events in typedUserEvents field.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[[["\u003cp\u003eThis endpoint, \u003ccode\u003eprojects.locations.instances.legacy.legacySearchUserEvents\u003c/code\u003e, is a legacy method for retrieving user events within a specific Chronicle instance.\u003c/p\u003e\n"],["\u003cp\u003eThe request is made via a \u003ccode\u003eGET\u003c/code\u003e request and requires specifying the instance in the path, along with the user and time range in the query parameters.\u003c/p\u003e\n"],["\u003cp\u003eThe response body will contain an array of \u003ccode\u003eUdmEventInfo\u003c/code\u003e objects under the \u003ccode\u003eevents\u003c/code\u003e field, which will either contain the requested users events or their asset events if the \u003ccode\u003euse_udm\u003c/code\u003e field is set to false, and includes flags indicating if there were too many user or asset events.\u003c/p\u003e\n"],["\u003cp\u003eTo use this endpoint, you need the \u003ccode\u003ehttps://www.googleapis.com/auth/cloud-platform\u003c/code\u003e OAuth scope and the \u003ccode\u003echronicle.legacies.legacySearchUserEvents\u003c/code\u003e IAM permission on the target instance.\u003c/p\u003e\n"],["\u003cp\u003eThe request body must be empty when making the request to this endpoint.\u003c/p\u003e\n"]]],[],null,["# Method: legacy.legacySearchUserEvents\n\n- [HTTP request](#body.HTTP_TEMPLATE)\n- [Path parameters](#body.PATH_PARAMETERS)\n- [Query parameters](#body.QUERY_PARAMETERS)\n- [Request body](#body.request_body)\n- [Response body](#body.response_body)\n - [JSON representation](#body.LegacySearchUserEventsResponse.SCHEMA_REPRESENTATION)\n- [Authorization scopes](#body.aspect)\n- [IAM Permissions](#body.aspect_1)\n- [Try it!](#try-it)\n\n**Full name**: projects.locations.instances.legacy.legacySearchUserEvents\n\nLegacy endpoint for getting events for a given user.\n\n### HTTP request\n\nChoose a location: \nafrica-south1 asia-northeast1 asia-south1 asia-southeast1 asia-southeast2 australia-southeast1 europe-west12 europe-west2 europe-west3 europe-west6 europe-west9 me-central1 me-central2 me-west1 northamerica-northeast2 southamerica-east1 us eu \n\n\u003cbr /\u003e\n\n### Path parameters\n\n### Query parameters\n\n### Request body\n\nThe request body must be empty.\n\n### Response body\n\nResponse for user telemetry data.\n\nIf successful, the response body contains data with the following structure:\n\n### Authorization scopes\n\nRequires the following OAuth scope:\n\n- `https://www.googleapis.com/auth/cloud-platform`\n\nFor more information, see the [Authentication Overview](/docs/authentication#authorization-gcp).\n\n### IAM Permissions\n\nRequires the following [IAM](https://cloud.google.com/iam/docs) permission on the `instance` resource:\n\n- `chronicle.legacies.legacySearchUserEvents`\n\nFor more information, see the [IAM documentation](https://cloud.google.com/iam/docs)."]]