SIEM API endpoint mapping
Supported in:
This document maps legacy SIEM API endpoints (Backstory API including Customer Management API, and Ingestion API) to their corresponding modern Chronicle API endpoints.
Authorization and partner delegation
In the Chronicle API, Identity and Access Management (IAM) replaces legacy API keys and tokens for access control. To access an instance directly, authenticate with OAuth 2.0 credentials for a service account or Workload Identity Federation principal. That principal must have the required IAM roles in the project that hosts the instance.
For partners, authorization depends on resource ownership. The project that hosts a resource determines which credentials and IAM permissions a partner needs. Scoping tenant operations to tenant-delegated credentials aligns with the core security principle that partners shouldn't be able to access, retrieve, or modify tenant data without explicit permission granted by the tenant. The following table compares partner authorization in the legacy Backstory API and the Chronicle API:
| API | Methods | Resource scope | Authorization |
|---|---|---|---|
| Legacy Backstory API | /v1/partner/customer/* endpoints |
All of the partner's customer codes | Partners call these endpoints directly with their own partner tokens or API keys. |
Chronicle API: TenantService |
CreateTenant, ListTenants, and UpdateTenant |
Partner's instance: projects/{partner_project}/locations/{location}/instances/{partner_instance}/tenants/* |
Partners call these methods directly with their own service accounts or credentials that have chronicle.googleapis.com/tenants.* permissions in the partner project. |
Chronicle API: other services, such as InstanceService and ForwarderService |
GetInstance, UpdateInstance, GenerateForwarderFiles, and other tenant-scoped methods |
Tenant's instance: projects/{tenant_project}/locations/{location}/instances/{tenant_instance}/... |
Partner credentials alone can't access or modify tenant data. The tenant administrator must grant IAM roles, such as roles/chronicle.admin, roles/chronicle.viewer, or a custom role, to the partner's service account or Workload Identity Federation principal in the tenant's Google Cloud project. |
API mapping table
| Feature area | Legacy API method | Legacy API version | Chronicle API method | IAM permission required | Detailed request and response mapping |
|---|---|---|---|---|---|
| BigQuery | UpdateBigQueryAccess |
v1 | ProvideBigQueryAccess | chronicle.googleapis.com/bigQueryAccesses.provide |
ProvideBigQueryAccess |
| CuratedRule | ListCuratedRuleDetections |
v2 | LegacySearchCuratedDetections | chronicle.googleapis.com/legacies.legacySearchCuratedDetections |
LegacySearchCuratedDetections |
| CuratedRule | ListCuratedRules |
v2 | ListCuratedRules | chronicle.googleapis.com/curatedRules.list |
ListCuratedRules |
| LegacyAlert | UpdateAlert |
v1 | LegacyUpdateAlert | chronicle.googleapis.com/legacies.legacyUpdateAlert |
LegacyUpdateAlert |
| LegacyAlert | CreateSoarAlert |
v1 | LegacyCreateSoarAlert | chronicle.googleapis.com/legacies.legacyCreateSoarAlert |
LegacyCreateSoarAlert |
| Case | CreateOrUpdateCase |
v1 | LegacyCreateOrUpdateCase | chronicle.googleapis.com/legacies.legacyCreateOrUpdateCase |
LegacyCreateOrUpdateCase |
| Data Export | CancelDataExport |
v1 | CancelDataExport | chronicle.googleapis.com/dataExports.cancel |
— |
| Data Export | CreateDataExport |
v1 | CreateDataExport | chronicle.googleapis.com/dataExports.create |
— |
| Data Export | GetDataExport |
v1 | GetDataExport | chronicle.googleapis.com/dataExports.get |
— |
| Data Export | ListAvailableLogTypes |
v1 | FetchLogTypesAvailableForExport | chronicle.googleapis.com/dataExports.fetchAvailableLogTypes |
— |
| DataTap | CreateDataTap |
v1 | CreateDataTap | chronicle.googleapis.com/dataTaps.create |
CreateDataTap |
| DataTap | DeleteDataTap |
v1 | DeleteDataTap | chronicle.googleapis.com/dataTaps.delete |
DeleteDataTap |
| DataTap | GetDataTap |
v1 | GetDataTap | chronicle.googleapis.com/dataTaps.get |
GetDataTap |
| DataTap | ListDataTaps |
v1 | ListDataTaps | chronicle.googleapis.com/dataTaps.list |
ListDataTaps |
| DataTap | UpdateDataTap |
v1 | UpdateDataTap | chronicle.googleapis.com/dataTaps.update |
UpdateDataTap |
| Feeds | CreateFeed |
v1 | CreateFeed | chronicle.googleapis.com/feeds.create |
CreateFeed |
| Feeds | DeleteFeed |
v1 | DeleteFeed | chronicle.googleapis.com/feeds.delete |
DeleteFeed |
| Feeds | DisableFeed |
v1 | DisableFeed | chronicle.googleapis.com/feeds.disable |
DisableFeed |
| Feeds | EnableFeed |
v1 | EnableFeed | chronicle.googleapis.com/feeds.enable |
EnableFeed |
| Feeds | FetchFeedServiceAccount |
v1 | FetchServiceAccountForCustomer | chronicle.googleapis.com/feedServiceAccounts.fetch |
FetchServiceAccountForCustomer |
| Feeds | GetFeed |
v1 | GetFeed | chronicle.googleapis.com/feeds.get |
GetFeed |
| Feeds | GetFeedSchema |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/logTypeSchemas.list |
ListLogTypeSchemas |
| Feeds | GetLogTypeSchema |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/logTypeSchemas.list |
ListLogTypeSchemas |
| Feeds | ListFeeds |
v1 | ListFeeds | chronicle.googleapis.com/feeds.list |
ListFeeds |
| Feeds | ListFeedSourceTypeSchemas |
v1 | ListFeedSourceTypeSchemas | chronicle.googleapis.com/feedSourceTypeSchemas.list |
ListFeedSourceTypeSchemas |
| Feeds | ListLogTypeSchemas |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/logTypeSchemas.list |
ListLogTypeSchemas |
| Feeds | UpdateFeed |
v1 | UpdateFeed | chronicle.googleapis.com/feeds.update |
UpdateFeed |
| Forwarder | CreateForwarder |
v2 | CreateForwarder | chronicle.googleapis.com/forwarders.create |
CreateForwarder |
| Forwarder | GetForwarder |
v2 | GetForwarder | chronicle.googleapis.com/forwarders.get |
GetForwarder |
| Forwarder | ListForwarders |
v2 | ListForwarders | chronicle.googleapis.com/forwarders.list |
ListForwarders |
| Forwarder | UpdateForwarder |
v2 | UpdateForwarder | chronicle.googleapis.com/forwarders.update |
UpdateForwarder |
| Forwarder | DeleteForwarder |
v2 | DeleteForwarder | chronicle.googleapis.com/forwarders.delete |
DeleteForwarder |
| Forwarder | GenerateForwarderFiles |
v2 | GenerateForwarderFiles | chronicle.googleapis.com/forwarders.generateFiles |
— |
| Forwarder | CreateCollector |
v2 | CreateCollector | chronicle.googleapis.com/collectors.create |
CreateCollector |
| Forwarder | GetCollector |
v2 | GetCollector | chronicle.googleapis.com/collectors.get |
GetCollector |
| Forwarder | ListCollectors |
v2 | ListCollectors | chronicle.googleapis.com/collectors.list |
ListCollectors |
| Forwarder | UpdateCollector |
v2 | UpdateCollector | chronicle.googleapis.com/collectors.update |
UpdateCollector |
| Forwarder | DeleteCollector |
v2 | DeleteCollector | chronicle.googleapis.com/collectors.delete |
DeleteCollector |
| Parser | ArchiveCbnParser |
v1 | DeactivateParser | chronicle.googleapis.com/parsers.deactivate |
DeactivateParser |
| Parser | CreateCbnParser |
v1 | CreateParser | chronicle.googleapis.com/parsers.create |
CreateParser |
| Parser | GetCbnParser |
v1 | GetParser | chronicle.googleapis.com/parsers.get |
GetParser |
| Parser | ListCbnParserHistory |
v1 | ListParsers | chronicle.googleapis.com/parsers.list |
ListParsers |
| Parser | ListCbnParsers |
v1 | ListParsers | chronicle.googleapis.com/parsers.list |
ListParsers |
| Parser | RetrieveSampleLogs |
v1 | ListLogs | chronicle.googleapis.com/logs.list |
ListLogs |
| Parser | ValidateCbnParser |
v1 | CreateParser | chronicle.googleapis.com/parsers.create |
CreateParser |
| Partner | CreateCustomer |
v1 | CreateTenant | chronicle.googleapis.com/tenants.create |
CreateTenant |
| Partner | GetCustomer |
v1 | GetInstance | chronicle.googleapis.com/instances.get |
— |
| Partner | GetForwarderConfigs |
v1 | GenerateForwarderFiles | chronicle.googleapis.com/forwarders.generateFiles |
— |
| Partner | ListCustomersOfPartner |
v1 | ListTenants | chronicle.googleapis.com/tenants.list |
— |
| Partner | SetAuthVersion |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
— |
| Partner | SetComplianceRequirements |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
— |
| Partner | SetUIState |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
— |
| Partner | SetWorkforcePoolProvider |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
— |
| ReferenceList | CreateReferenceList |
v2 | CreateReferenceList | chronicle.googleapis.com/referenceLists.create |
CreateReferenceList |
| ReferenceList | VerifyReferenceList |
v2 | VerifyReferenceList | chronicle.googleapis.com/referenceLists.verifyReferenceList |
VerifyReferenceList |
| ReferenceList | GetReferenceList |
v2 | GetReferenceList | chronicle.googleapis.com/referenceLists.get |
GetReferenceList |
| ReferenceList | ListReferenceLists |
v2 | ListReferenceLists | chronicle.googleapis.com/referenceLists.list |
ListReferenceLists |
| ReferenceList | UpdateReferenceList |
v2 | UpdateReferenceList | chronicle.googleapis.com/referenceLists.update |
UpdateReferenceList |
| Retrohunt | RunRetrohunt |
v2 | CreateRetrohunt | chronicle.googleapis.com/retrohunts.create |
CreateRetrohunt |
| Retrohunt | ListRetrohunts |
v2 | ListRetrohunts | chronicle.googleapis.com/retrohunts.list |
ListRetrohunts |
| Retrohunt | GetRetrohunt |
v2 | GetRetrohunt | chronicle.googleapis.com/retrohunts.get |
GetRetrohunt |
| Retrohunt | CancelRetrohunt |
v2 | CancelOperation | chronicle.googleapis.com/operations.cancel |
— |
| Retrohunt | WaitRetrohunt |
v2 | GetOperation | chronicle.googleapis.com/operations.get |
— |
| Rule | GetRule |
v2 | GetRule | chronicle.googleapis.com/rules.get |
GetRule |
| Rule | CreateRule |
v2 | CreateRule | chronicle.googleapis.com/rules.create |
CreateRule |
| Rule | VerifyRule |
v2 | VerifyRuleText | chronicle.googleapis.com/rules.verifyRuleText |
VerifyRuleText |
| Rule | ListRules |
v2 | ListRules | chronicle.googleapis.com/rules.list |
ListRules |
| Rule | DeleteRule |
v2 | DeleteRule | chronicle.googleapis.com/rules.delete |
DeleteRule |
| Rule | ArchiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Rule | UnarchiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Rule | EnableLiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Rule | DisableLiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Rule | ListRuleVersions |
v2 | ListRuleVersions | chronicle.googleapis.com/ruleVersions.list |
— |
| Rule | CreateRuleVersion |
v2 | CreateRule | chronicle.googleapis.com/rules.create |
CreateRule |
| Rule | EnableAlerting |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Rule | DisableAlerting |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Rule | ListDetections |
v2 | LegacySearchDetections | chronicle.googleapis.com/legacies.legacySearchDetections |
LegacySearchDetections |
| Rule | GetDetection |
v2 | LegacyGetDetection | chronicle.googleapis.com/legacies.legacyGetDetection |
LegacyGetDetection |
| Rule | StreamDetectionAlerts |
v2 | LegacyStreamDetectionAlerts | chronicle.googleapis.com/legacies.legacyStreamDetectionAlerts |
LegacyStreamDetectionAlerts |
| Rule | StreamTestRule |
v2 | LegacyTestRuleStreaming | chronicle.googleapis.com/legacies.legacyTestRuleStreaming |
LegacyTestRuleStreaming |
| Rules | CreateRule |
v1 | CreateRule | chronicle.googleapis.com/rules.create |
CreateRule |
| Rules | GetRule |
v1 | GetRule | chronicle.googleapis.com/rules.get |
GetRule |
| Rules | UpdateRule |
v1 | UpdateRule | chronicle.googleapis.com/rules.update |
UpdateRule |
| Rules | DeleteRule |
v1 | DeleteRule | chronicle.googleapis.com/rules.delete |
DeleteRule |
| Rules | EnableLiveRule |
v1 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Rules | ListResults |
v1 | LegacySearchRuleResults | chronicle.googleapis.com/legacies.legacySearchRuleResults |
LegacySearchRuleResults |
| Rules | ListRules |
v1 | ListRules | chronicle.googleapis.com/rules.list |
ListRules |
| Rules | RunRule |
v1 | CreateRetrohunt | chronicle.googleapis.com/retrohunts.create |
CreateRetrohunt |
| Alerts | StreamDetections |
v1 | StreamDetectionAlerts | chronicle.googleapis.com/legacies.streamDetectionAlerts |
LegacyStreamDetectionAlerts |
| Alerts | StreamRuleNotifications |
v1 | StreamDetectionAlerts | chronicle.googleapis.com/legacies.streamDetectionAlerts |
LegacyStreamDetectionAlerts |
| Search | FetchUdmSearchView |
v1 | LegacyFetchUdmSearchView | chronicle.googleapis.com/legacies.legacyFetchUdmSearchView |
LegacyFetchUdmSearchView |
| Search | GetEvent |
v1 | GetEvent | chronicle.googleapis.com/events.get |
GetEvent |
| Log | GetLog |
v1 | GetLog | chronicle.googleapis.com/logs.get |
— |
| Search | ListArtifactAssets |
v1 | FindRelatedEntities | chronicle.googleapis.com/entities.findRelated |
FindRelatedEntities |
| IOC | ListArtifactIoCDetails |
v1 | LegacySearchArtifactIoCDetails | chronicle.googleapis.com/legacies.legacySearchArtifactIoCDetails |
— |
| Search | ListEvents |
v1 | LegacySearchAssetEvents | chronicle.googleapis.com/legacies.legacySearchAssetEvents |
LegacySearchAssetEvents |
| IOC | ListIoCs |
v1 | ListIocMatches | chronicle.googleapis.com/iocMatches.list |
— |
| Search | SearchRawLogs |
v1 | SearchRawLogs | chronicle.googleapis.com/rawLogs.search |
SearchRawLogs |
| Search | UdmSearch |
v1 | UdmSearch | chronicle.googleapis.com/events.udmSearch |
UdmSearch |
| Search | ListAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
SummarizeEntity |
| Search | ListAssetAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
SummarizeEntity |
| Search | ListUserAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
SummarizeEntity |
| Uppercase Alerts | GetUppercaseAlert |
v1 | LegacySearchFindings | chronicle.googleapis.com/legacies.legacySearchFindings. Note: Endpoint implementation was removed from Backstory in mid-2023. |
— |
| Uppercase Alerts | ListUppercaseAlerts |
v1 | LegacySearchFindings | chronicle.googleapis.com/legacies.legacySearchFindings. Note: Endpoint implementation was removed from Backstory in mid-2023. |
— |
| Ingestion API | BatchCreateEntities |
v2 | ImportEntities | chronicle.googleapis.com/entities.import |
ImportEntities |
| Ingestion API | BatchCreateEvents |
v2 | ImportStatsEvents | chronicle.googleapis.com/forwarders.importStatsEvents |
ImportStatsEvents |
| Ingestion API | BatchCreateLogs |
v2 | ImportLogs | chronicle.googleapis.com/logs.import |
ImportLogs |
| Ingestion API | BatchCreateUDMEvents |
v2 | ImportEvents | chronicle.googleapis.com/events.import |
ImportEvents |
| Ingestion API | BatchCreateUnstructuredLogEntries |
v2 | ImportLogs | chronicle.googleapis.com/logs.import |
— |
| Ingestion API | CreateEntities |
v1 | ImportEntities | chronicle.googleapis.com/entities.import |
ImportEntities |
| Ingestion API | CreateUDMEvents |
v1 | ImportEvents | chronicle.googleapis.com/events.import |
ImportEvents |
| Ingestion API | CreateUnstructuredLogEntries |
v1 | ImportLogs | chronicle.googleapis.com/logs.import |
ImportLogs |
| Ingestion API | ListLogTypes |
v1 | ListLogTypes | chronicle.googleapis.com/logTypes.list |
ListLogTypes |
| Ingestion API | ListSupportedLogTypes |
v2 | ListLogTypeSettings | chronicle.googleapis.com/logTypeSettings.list |
ListLogTypeSettings |
| Ingestion API | PutEvent |
v1 | ImportEvents | chronicle.googleapis.com/events.import |
ImportEvents |
| Ingestion API | PutLog |
v1 | UpdateLogType | chronicle.googleapis.com/logTypes.update |
UpdateLogType |
For more information about migrating from the Ingestion API to the Chronicle API, see Chronicle API ingestion methods.
Unmapped and removed endpoints
The following table lists the legacy API endpoints that are not mapped to the modern Chronicle API and are scheduled for removal, along with the business rationale:
| Feature area | Legacy API method | Legacy API version | Justification |
|---|---|---|---|
| Legacy RBAC | CreateSubject |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | DeleteSubject |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | GetSubject |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | ListRoles |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | ListSubjects |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | UpdateRole |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | UpdateSubject |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Parser | ListCbnParserErrors |
v1 | No longer required or available in the modern parser management workflow. |
| Partner | EnableIAM |
v1 | Feature was already deprecated and is handled using standard Google Cloud mechanisms. |
| Partner | GenerateIamMigrationCommands |
v1 | Feature was already deprecated and is redundant in the modern architecture. |
| Partner | GenerateIdPMetadata |
v1 | Redundant in the modern Google Cloud-integrated architecture. |
| Partner | GetIngestionFilter |
v1 | Redundant in the modern Google Cloud-integrated architecture. |
| Partner | SetGCPProjectLink |
v1 | Redundant in the modern Google Cloud-integrated architecture. |
| Uppercase Alerts | CreateCorrespondence |
v1 | Feature was already deprecated. |
Need more help? Get answers from Community members and Google SecOps professionals.