Full name: projects.locations.instances.translateYlRule
Translate natural language to a Yara-L rule.
HTTP request
Path parameters
Parameters
instance
string
Required. The name of the parent resource, which is the SecOps instance associated with the request. Format: projects/{project}/locations/{location}/instances/{instance}
Request body
The request body contains data with the following structure:
JSON representation
{"text": string,"udmQuery": string}
Fields
text
string
Required. Natural language text description for the rule.
udmQuery
string
Required. UDM query generated from the text via instances.translateUdmQuery.
Response body
Response message for instances.translateYlRule.
If successful, the response body contains data with the following structure:
JSON representation
{"ruleText": string,"message": string}
Fields
ruleText
string
The translated YARA-L rule text.
message
string
Optional. The message to be shown to the user if the translation was unsuccessful.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[[["\u003cp\u003eThis page details the \u003ccode\u003eprojects.locations.instances.translateYlRule\u003c/code\u003e API endpoint, which translates natural language into a Yara-L rule.\u003c/p\u003e\n"],["\u003cp\u003eThe endpoint uses a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003ehttps://chronicle.googleapis.com/v1alpha/{instance}:translateYlRule\u003c/code\u003e, requiring the instance in the path parameters.\u003c/p\u003e\n"],["\u003cp\u003eThe request body requires both natural language \u003ccode\u003etext\u003c/code\u003e and a \u003ccode\u003eudm_query\u003c/code\u003e generated from that text, both of which are strings.\u003c/p\u003e\n"],["\u003cp\u003eA successful response contains a \u003ccode\u003erule_text\u003c/code\u003e field with the translated YARA-L rule and an optional \u003ccode\u003emessage\u003c/code\u003e field.\u003c/p\u003e\n"],["\u003cp\u003eAccess to this API requires the OAuth scope \u003ccode\u003ehttps://www.googleapis.com/auth/cloud-platform\u003c/code\u003e and the IAM permission \u003ccode\u003echronicle.ais.translateYlRule\u003c/code\u003e on the specified instance.\u003c/p\u003e\n"]]],[],null,[]]
