Full name: projects.locations.instances.watchlists.entities.add
Adds an entity in watchlist.
HTTP request
POST https://chronicle.googleapis.com/v1alpha/{parent}/entities:add
Path parameters
Parameters
parent
string
Required. The parent resource where this entity will be added. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
Request body
The request body contains data with the following structure:
Required. The entity to add. Note that one and only one of the following field should be populated: - entity.asset.ip (with only one element) - entity.asset.mac (with only one element) - entity.asset.hostname - entity.asset.product_object_id - entity.user.userid - entity.user.email_addresses (with only one element) - entity.user.employee_id - entity.user.windows_sid - entity.user.product_object_id On the other hand, entity.namespace is optional.
Response body
If successful, the response body contains an instance of Entity.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-07-14 UTC."],[[["\u003cp\u003eThis API endpoint, \u003ccode\u003eprojects.locations.instances.watchlists.entities.add\u003c/code\u003e, is used to add an entity to a specified watchlist.\u003c/p\u003e\n"],["\u003cp\u003eThe HTTP request is a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003ehttps://chronicle.googleapis.com/v1alpha/{parent}/entities:add\u003c/code\u003e, where \u003ccode\u003e{parent}\u003c/code\u003e indicates the resource path of the watchlist.\u003c/p\u003e\n"],["\u003cp\u003eThe request body requires a JSON object containing an \u003ccode\u003eentity\u003c/code\u003e field, which represents the entity being added, and should only have one of the specified fields populated.\u003c/p\u003e\n"],["\u003cp\u003eSuccessful requests will return an instance of \u003ccode\u003eEntity\u003c/code\u003e in the response body.\u003c/p\u003e\n"],["\u003cp\u003eAuthorization requires the \u003ccode\u003ehttps://www.googleapis.com/auth/cloud-platform\u003c/code\u003e OAuth scope and the \u003ccode\u003echronicle.entities.create\u003c/code\u003e IAM permission on the parent resource.\u003c/p\u003e\n"]]],[],null,[]]
