Method: threatCollections.fetchRuleMetadata

Full name: projects.locations.instances.threatCollections.fetchRuleMetadata

Gets a batch (list) of rule metadata for a list of threat collections.

HTTP request


Path parameters

Parameters
parent

string

Required. The parent resource of the rule metadata. Format: projects/{project}/locations/{location}/instances/{instance}

Query parameters

Parameters
threatCollections[]

string

Required. The resource names of the ThreatCollections to fetch rule metadata for. Format: projects/{project}/locations/{location}/instances/{instance}/threatCollections/{threatCollection}

Request body

The request body must be empty.

Response body

Response containing a list of rule metadata.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "ruleMetadata": {
    string: {
      object (ThreatCollectionRuleMetadata)
    },
    ...
  }
}
Fields
ruleMetadata

map (key: string, value: object (ThreatCollectionRuleMetadata))

Output only. Map of requested threat collection resource name to rule metadata. Format: - Key (string): projects/{project}/locations/{location}/instances/{instance}/threatCollections/{threatCollection} - Value (ThreatCollectionRuleMetadata): ThreatCollectionRuleMetadata

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

  • chronicle.threatCollections.fetchRuleMetadata

For more information, see the IAM documentation.

ThreatCollectionRuleMetadata

Rule metadata for a threat collection.

JSON representation 
{
  "detectionsCount": integer,
  "rules": [
    string
  ]
}
Fields
detectionsCount

integer

Number of detections, both alerting and non-alerting, associated with the ThreatCollection
rules[]

string

The rules associated with the ThreatCollection. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}