Method: legacySdk.legacyGetAlertsToSync

Full name: projects.locations.instances.legacySdk.legacyGetAlertsToSync

Legacy RPC for get alerts to sync.

HTTP request


Path parameters

Parameters
instance

string

Required. The GetAlertsToSync request. Format: projects/{project}/locations/{location}/instances/{instance}/legacySdk:getAlertsToSync

Request body

The request body contains data with the following structure:

JSON representation 
{
  "batchSize": integer,
  "environments": [
    string
  ]
}
Fields
batchSize

integer

Required. The alerts to sync request data.
environments[]

string

Required. Filter alerts which only belong to the given environments. If Environments is null or empty, then, no filtering will take place (alerts will be searched in all environments).

Response body

The GetAlertsToSyncResponse message.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "payload": [
    {
      object (SdkApiSyncNewAlert)
    }
  ]
}
Fields
payload[]

object (SdkApiSyncNewAlert)

The list of alerts to sync.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

SdkApiSyncNewAlert

ApiSyncNewAlert message.

JSON representation 
{
  "alertIdentifier": string,
  "alertGroupIdentifier": string,
  "creationTime": string,
  "name": string,
  "detectionTime": string,
  "vendor": string,
  "sourceSystemName": string,
  "product": string,
  "ticketId": string,
  "environment": string,
  "siemAlertId": string,
  "events": [
    {
      object (SdkApiSyncSecurityEvent)
    }
  ],
  "startTime": string,
  "endTime": string
}
Fields
alertIdentifier

string

Alert identifier - {alertName}_{ticketId}
alertGroupIdentifier

string

A unique identifier of the alert, across the whole system.
creationTime

string (int64 format)

Alert creation time in unix format as milliseconds
name

string

Alert display name
detectionTime

string (int64 format)

Detected time in unix ms. The detection time of the alert in unix format as milliseconds.
vendor

string

The vendor name of the product which generated the alert.
sourceSystemName

string

The integration which ingested the alert.
product

string

The name of the product which generated the alert.
ticketId

string

Original identifier of the alert in its source system.
environment

string

Environment name which the alert is associated with.
siemAlertId

string

Chronicle SIEM alert identifier.
events[]

object (SdkApiSyncSecurityEvent)

The events involved in this alert.
startTime

string (int64 format)

Alert start time in unix format as milliseconds.
endTime

string (int64 format)

Alert end time in unix format as milliseconds.

SdkApiSyncSecurityEvent

ApiSyncSecurityEvent message.

JSON representation 
{
  "eventTimeEpochTimeInMs": string,
  "name": string,
  "severity": string,
  "description": string,
  "eventId": string,
  "receiptTime": string,
  "managerReceiptTime": string,
  "startTime": string,
  "sourceHostName": string,
  "sourceAddress": string,
  "destinationHostName": string,
  "destinationAddress": string,
  "destinationUserName": string,
  "destinationDnsDomain": string,
  "destinationNtDomain": string,
  "sourceDnsDomain": string,
  "sourceUserName": string,
  "sourceUserId": string,
  "sourceNtDomain": string,
  "destinationUrl": string,
  "fileName": string,
  "fileHash": string,
  "deployment": string,
  "fileType": string,
  "transportProtocol": string,
  "applicationProtocol": string,
  "destinationPort": string,
  "categoryOutcome": string,
  "deviceVendor": string,
  "deviceProduct": string,
  "sourceProcessName": string,
  "destinationProcessName": string,
  "emailSubject": string,
  "threatSignature": string,
  "genericEntity": string,
  "sourceMacAddress": string,
  "destinationMacAddress": string,
  "phoneNumber": string,
  "cve": string,
  "threatActor": string,
  "threatCampaign": string,
  "process": string,
  "parentProcess": string,
  "sourceDomain": string,
  "destinationDomain": string,
  "endTime": string,
  "ruleGenerator": string,
  "message": string,
  "usb": string
}
Fields
eventTimeEpochTimeInMs

string

The event time in unix ms.
name

string

The event name.
severity

string

The severity.
description

string

The description.
eventId

string

The event id.
receiptTime

string

The receipt time.
managerReceiptTime

string

The manager receipt time.
startTime

string

The start time.
sourceHostName

string

The source host name.
sourceAddress

string

The source address.
destinationHostName

string

The destination host name.
destinationAddress

string

The destination address.
destinationUserName

string

The destination user name.
destinationDnsDomain

string

The destination dns domain.
destinationNtDomain

string

The destination nt domain.
sourceDnsDomain

string

The source dns domain.
sourceUserName

string

The source user name.
sourceUserId

string

The source user id.
sourceNtDomain

string

The source nt domain.
destinationUrl

string

The destination url.
fileName

string

The file name.
fileHash

string

The file hash.
deployment

string

The deployment.
fileType

string

The file type.
transportProtocol

string

The transport protocol.
applicationProtocol

string

The application protocol.
destinationPort

string

The destination port.
categoryOutcome

string

The category outcome.
deviceVendor

string

The device vendor.
deviceProduct

string

The device product.
sourceProcessName

string

The source process name.
destinationProcessName

string

The destination process name.
emailSubject

string

The email subject.
threatSignature

string

The threat signature.
genericEntity

string

The generic entity.
sourceMacAddress

string

The source mac address.
destinationMacAddress

string

The destination mac address.
phoneNumber

string

The phone number.
cve

string

The cve.
threatActor

string

The threat actor.
threatCampaign

string

The threat campaign.
process

string

The process.
parentProcess

string

The parent process.
sourceDomain

string

The source domain.
destinationDomain

string

The destination domain.
endTime

string

The end time.
ruleGenerator

string

The rule generator.
message

string

The message.
usb

string

The usb.