REST Resource: projects.locations.instances.ontologyRecords.visualFamilies

Resource: VisualFamily

This service is available for customers who migrated SOAR to a customer managed project and have the Chronicle API enabled. A Visual Family defines a group of related entities and their possible relationships, visualized through an image and supporting modeling rules. This allows for the creation of meaningful representations of complex data connections.

JSON representation 
{
  "name": string,
  "family": string,
  "description": string,
  "imageBase64": string,
  "modelingRules": [
    {
      object (ModelingRule)
    }
  ],
  "id": string,
  "custom": boolean
}
Fields
name

string

Output only. Identifier. The resource name of the VisualFamily. Format: projects/{project}/locations/{location}/instances/{instance}/ontologyRecords/{ontologyRecord}/visualFamilies/{visualFamily}
family

string

Required. The name of the visual family (e.g., "InsiderThreat").
description

string

Required. A description of the visual family.
imageBase64

string

Output only. Base64 encoded image for the visual family.
modelingRules[]

object (ModelingRule)

Required. The modeling rules associated with this visual family.
id

string (int64 format)

Output only. Unique numeric ID for the VisualFamily.
custom

boolean

Output only. Indicates if this is a custom visual family.

ModelingRule

A modeling rule defines the relationships between source and destination entities in a visual family.

JSON representation 
{
  "primarySource": string,
  "relationType": enum (RelationType),
  "primaryDestination": string,
  "secondarySource": string,
  "thirdSource": string,
  "fourthSource": string,
  "secondaryDestination": string,
  "thirdDestination": string,
  "fourthDestination": string
}
Fields
primarySource

string

Required. The primary source entity.
relationType

enum (RelationType)

Required. The type of relation between the source and destination entities.
primaryDestination

string

Required. The primary destination entity.
secondarySource

string

Optional. The secondary source entity (optional).
thirdSource

string

Optional. The third source entity (optional).
fourthSource

string

Optional. The fourth source entity (optional).
secondaryDestination

string

Optional. The secondary destination entity (optional).
thirdDestination

string

Optional. The third destination entity (optional).
fourthDestination

string

Optional. The fourth destination entity (optional).

RelationType

The type of relation between the source and destination entities.

Enums
RELATION_TYPE_UNSPECIFIED The relation type is unspecified.
LINKED This relation type will attach the entities with a dashed arrow.
TYPE This relation type will attach the entities with an arrow. Type is the actual event, there could be only one type relation in each visual family.

Methods

create

 Creates a new VisualFamily.

delete

 Deletes a VisualFamily.

export

 Exports VisualFamilies.

get

 Gets a VisualFamily.

import

 Imports VisualFamilies.

list

 Lists VisualFamilies in a given ontology record.

patch

 Updates a VisualFamily.