Method: instances.findEntity

Full name: projects.locations.instances.findEntity

Identifies the entity type and retrieves relevant data associated with a specified indicator.

HTTP request

GET https://chronicle.googleapis.com/v1alpha/{instance}:findEntity

Path parameters

Parameters
instance

string

Required. The ID of the Instance to find entity for. Format: projects/{project}/locations/{location}/instances/{instance}

Query parameters

Parameters
indicator

string

Required. Entity indicator to search for.
udmField

string

Required. The UDM field the entity indicator belongs to.
entityNamespace

string

Required. Namespace of the entity being queried.
referenceTime

string (Timestamp format)

Required. Reference time to lookup entity.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Request body

The request body must be empty.

Response body

Response message for find entity given an indicator.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "entity": {
    object (Entity)
  }
}
Fields
entity

object (Entity)

A list of entity summaries.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the instance resource:

  • chronicle.entities.find

For more information, see the IAM documentation.