SIEM API endpoint mapping
Supported in:
This document maps legacy SIEM API endpoints (Backstory API including Customer Management API, and Ingestion API) to their corresponding modern Chronicle API endpoints.
API mapping table
| Feature area | Legacy API | Legacy method | Chronicle API method | IAM permission required |
|---|---|---|---|---|
| BigQuery | UpdateBigQueryAccess |
RPC (v1) | ProvideBigQueryAccess | chronicle.googleapis.com/bigQueryAccesses.provide |
| CuratedRule | ListCuratedRuleDetections |
RPC (v2) | LegacySearchCuratedDetections | chronicle.googleapis.com/legacies.legacySearchCuratedDetections |
| CuratedRule | ListCuratedRules |
RPC (v2) | ListCuratedRules | chronicle.googleapis.com/curatedRules.list |
| DAI - LegacyAlert | UpdateAlert |
RPC (v1) | LegacyUpdateAlert | chronicle.googleapis.com/legacies.legacyUpdateAlert |
| DAI - Case | CreateOrUpdateCase |
RPC (v1) | LegacyCreateOrUpdateCase | chronicle.googleapis.com/legacies.legacyCreateOrUpdateCase |
| Data Export | CancelDataExport |
RPC (v1) | CancelDataExport | chronicle.googleapis.com/dataExports.cancel |
| Data Export | CreateDataExport |
RPC (v1) | CreateDataExport | chronicle.googleapis.com/dataExports.create |
| Data Export | GetDataExport |
RPC (v1) | GetDataExport | chronicle.googleapis.com/dataExports.get |
| Data Export | ListAvailableLogTypes |
RPC (v1) | FetchLogTypesAvailableForExport | chronicle.googleapis.com/dataExports.fetchAvailableLogTypes |
| DataTap | CreateDataTap |
RPC (v1) | CreateDataTap | chronicle.googleapis.com/dataTaps.create |
| DataTap | DeleteDataTap |
RPC (v1) | DeleteDataTap | chronicle.googleapis.com/dataTaps.delete |
| DataTap | GetDataTap |
RPC (v1) | GetDataTap | chronicle.googleapis.com/dataTaps.get |
| DataTap | ListDataTaps |
RPC (v1) | ListDataTaps | chronicle.googleapis.com/dataTaps.list |
| DataTap | UpdateDataTap |
RPC (v1) | UpdateDataTap | chronicle.googleapis.com/dataTaps.update |
| Feeds | CreateFeed |
RPC (v1) | CreateFeed | chronicle.googleapis.com/feeds.create |
| Feeds | DeleteFeed |
RPC (v1) | DeleteFeed | chronicle.googleapis.com/feeds.delete |
| Feeds | DisableFeed |
RPC (v1) | DisableFeed | chronicle.googleapis.com/feeds.disable |
| Feeds | EnableFeed |
RPC (v1) | EnableFeed | chronicle.googleapis.com/feeds.enable |
| Feeds | FetchFeedServiceAccount |
RPC (v1) | FetchServiceAccountForCustomer | chronicle.googleapis.com/feeds.fetchServiceAccount |
| Feeds | GetFeed |
RPC (v1) | GetFeed | chronicle.googleapis.com/feeds.get |
| Feeds | GetFeedSchema |
RPC (v1) | ListLogTypeSchemas | chronicle.googleapis.com/feeds.listLogTypeSchemas |
| Feeds | GetLogTypeSchema |
RPC (v1) | ListLogTypeSchemas | chronicle.googleapis.com/feeds.listLogTypeSchemas |
| Feeds | ListFeeds |
RPC (v1) | ListFeeds | chronicle.googleapis.com/feeds.list |
| Feeds | ListFeedSourceTypeSchemas |
RPC (v1) | ListFeedSourceTypeSchemas | chronicle.googleapis.com/feeds.listFeedSourceTypeSchemas |
| Feeds | ListLogTypeSchemas |
RPC (v1) | ListLogTypeSchemas | chronicle.googleapis.com/feeds.listLogTypeSchemas |
| Feeds | UpdateFeed |
RPC (v1) | UpdateFeed | chronicle.googleapis.com/feeds.update |
| Forwarder | CreateForwarder |
RPC (v2) | CreateForwarder | chronicle.googleapis.com/forwarders.create |
| Forwarder | GetForwarder |
RPC (v2) | GetForwarder | chronicle.googleapis.com/forwarders.get |
| Forwarder | ListForwarders |
RPC (v2) | ListForwarders | chronicle.googleapis.com/forwarders.list |
| Forwarder | UpdateForwarder |
RPC (v2) | UpdateForwarder | chronicle.googleapis.com/forwarders.update |
| Forwarder | DeleteForwarder |
RPC (v2) | DeleteForwarder | chronicle.googleapis.com/forwarders.delete |
| Forwarder | GenerateForwarderFiles |
RPC (v2) | GenerateForwarderFiles | chronicle.googleapis.com/forwarders.generateFiles |
| Forwarder | CreateCollector |
RPC (v2) | CreateCollector | chronicle.googleapis.com/collectors.create |
| Forwarder | GetCollector |
RPC (v2) | GetCollector | chronicle.googleapis.com/collectors.get |
| Forwarder | ListCollectors |
RPC (v2) | ListCollectors | chronicle.googleapis.com/collectors.list |
| Forwarder | UpdateCollector |
RPC (v2) | UpdateCollector | chronicle.googleapis.com/collectors.update |
| Forwarder | DeleteCollector |
RPC (v2) | DeleteCollector | chronicle.googleapis.com/collectors.delete |
| Parser | ArchiveCbnParser |
RPC (v1) | DeactivateParser | chronicle.googleapis.com/parsers.deactivate |
| Parser | CreateCbnParser |
RPC (v1) | CreateParser | chronicle.googleapis.com/parsers.create |
| Parser | GetCbnParser |
RPC (v1) | GetParser | chronicle.googleapis.com/parsers.get |
| Parser | ListCbnParserHistory |
RPC (v1) | ListParsers (Note: ListCbnParserHistory lists all parsers, same as ListParsers) |
chronicle.googleapis.com/parsers.list |
| Parser | ListCbnParsers |
RPC (v1) | ListParsers | chronicle.googleapis.com/parsers.list |
| Parser | RetrieveSampleLogs |
RPC (v1) | ListLogs | chronicle.googleapis.com/logs.list |
| Parser | ValidateCbnParser |
RPC (v1) | CreateParser | chronicle.googleapis.com/parsers.create |
| Partner | CreateCustomer |
RPC (v1) | CreateTenant | chronicle.googleapis.com/tenants.create |
| Partner | GetCustomer |
RPC (v1) | GetInstance | chronicle.googleapis.com/instances.get |
| Partner | GetForwarderConfigs |
RPC (v1) | GenerateForwarderFiles | chronicle.googleapis.com/forwarders.generateFiles |
| Partner | ListCustomersOfPartner |
RPC (v1) | ListTenants | chronicle.googleapis.com/tenants.list |
| Partner | SetAuthVersion |
RPC (v1) | UpdateInstance | chronicle.googleapis.com/instances.update |
| Partner | SetComplianceRequirements |
RPC (v1) | UpdateInstance | chronicle.googleapis.com/instances.update |
| Partner | SetUIState |
RPC (v1) | UpdateInstance | chronicle.googleapis.com/instances.update |
| Partner | SetWorkforcePoolProvider |
RPC (v1) | UpdateInstance | chronicle.googleapis.com/instances.update |
| ReferenceList | CreateReferenceList |
RPC (v2) | CreateReferenceList | chronicle.googleapis.com/referenceLists.create |
| ReferenceList | VerifyReferenceList |
RPC (v2) | VerifyReferenceList | chronicle.googleapis.com/referenceLists.verify |
| ReferenceList | GetReferenceList |
RPC (v2) | GetReferenceList | chronicle.googleapis.com/referenceLists.get |
| ReferenceList | ListReferenceLists |
RPC (v2) | ListReferenceLists | chronicle.googleapis.com/referenceLists.list |
| ReferenceList | UpdateReferenceList |
RPC (v2) | UpdateReferenceList | chronicle.googleapis.com/referenceLists.update |
| Retrohunt | RunRetrohunt |
RPC (v2) | CreateRetrohunt | chronicle.googleapis.com/retrohunts.create |
| Retrohunt | ListRetrohunts |
RPC (v2) | ListRetrohunts | chronicle.googleapis.com/retrohunts.list |
| Retrohunt | GetRetrohunt |
RPC (v2) | GetRetrohunt | chronicle.googleapis.com/retrohunts.get |
| Retrohunt | CancelRetrohunt |
RPC (v2) | CancelOperation | chronicle.googleapis.com/operations.cancel |
| Retrohunt | WaitRetrohunt |
RPC (v2) | GetOperation | chronicle.googleapis.com/operations.get |
| Rule | GetRule |
RPC (v2) | GetRule | chronicle.googleapis.com/rules.get |
| Rule | CreateRule |
RPC (v2) | CreateRule | chronicle.googleapis.com/rules.create |
| Rule | VerifyRule |
RPC (v2) | VerifyRuleText | chronicle.googleapis.com/rules.verifyRuleText |
| Rule | ListRules |
RPC (v2) | ListRules | chronicle.googleapis.com/rules.list |
| Rule | DeleteRule |
RPC (v2) | DeleteRule | chronicle.googleapis.com/rules.delete |
| Rule | ArchiveRule |
RPC (v2) | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | UnarchiveRule |
RPC (v2) | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | EnableLiveRule |
RPC (v2) | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | DisableLiveRule |
RPC (v2) | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | ListRuleVersions |
RPC (v2) | ListRuleVersions | chronicle.googleapis.com/ruleVersions.list |
| Rule | CreateRuleVersion |
RPC (v2) | CreateRule | chronicle.googleapis.com/rules.create |
| Rule | EnableAlerting |
RPC (v2) | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | DisableAlerting |
RPC (v2) | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | ListDetections |
RPC (v2) | LegacySearchDetections | chronicle.googleapis.com/legacies.legacySearchDetections |
| Rule | GetDetection |
RPC (v2) | LegacyGetDetection | chronicle.googleapis.com/legacies.legacyGetDetection |
| Rule | StreamDetectionAlerts |
RPC (v2) | LegacyStreamDetectionAlerts | chronicle.googleapis.com/legacies.legacyStreamDetectionAlerts |
| Rule | StreamTestRule |
RPC (v2) | LegacyTestRuleStreaming | chronicle.googleapis.com/legacies.legacyTestRuleStreaming |
| Rules | CreateRule |
RPC (v1) | CreateRule | chronicle.googleapis.com/rules.create |
| Rules | GetRule |
RPC (v1) | GetRule | chronicle.googleapis.com/rules.get |
| Rules | UpdateRule |
RPC (v1) | UpdateRule | chronicle.googleapis.com/rules.update |
| Rules | DeleteRule |
RPC (v1) | DeleteRule | chronicle.googleapis.com/rules.delete |
| Rules | EnableLiveRule |
RPC (v1) | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rules | ListResults |
RPC (v1) | LegacySearchRuleResults | chronicle.googleapis.com/legacies.legacySearchRuleResults |
| Rules | ListRules |
RPC (v1) | ListRules | chronicle.googleapis.com/rules.list |
| Rules | RunRule |
RPC (v1) | CreateRetrohunt | chronicle.googleapis.com/retrohunts.create |
| Alerts | StreamDetections |
RPC (v1) | StreamDetectionAlerts | chronicle.googleapis.com/legacies.streamDetectionAlerts |
| Alerts | StreamRuleNotifications |
RPC (v1) | StreamDetectionAlerts | chronicle.googleapis.com/legacies.streamDetectionAlerts |
| Search | FetchUdmSearchView |
RPC (v1) | LegacyFetchUdmSearchView | chronicle.googleapis.com/legacies.legacyFetchUdmSearchView |
| Search | GetEvent |
RPC (v1) | GetEvent | chronicle.googleapis.com/events.get |
| Log | GetLog |
RPC (v1) | GetLog | chronicle.googleapis.com/logs.get |
| Alerts | ListAlerts |
RPC (v1) | LegacySearchAlerts | chronicle.googleapis.com/legacies.legacySearchAlerts |
| Search | ListArtifactAssets |
RPC (v1) | FindRelatedEntities | chronicle.googleapis.com/entities.findRelated |
| IOC | ListArtifactIoCDetails |
RPC (v1) | LegacySearchArtifactIoCDetails | chronicle.googleapis.com/legacies.legacySearchArtifactIoCDetails |
| Search | ListEvents |
RPC (v1) | LegacySearchAssetEvents | chronicle.googleapis.com/legacies.legacySearchAssetEvents |
| IOC | ListIoCs |
RPC (v1) | ListIocMatches | chronicle.googleapis.com/iocMatches.list |
| Search | SearchRawLogs |
RPC (v1) | SearchRawLogs | chronicle.googleapis.com/rawLogs.search |
| Search | UdmSearch |
RPC (v1) | UdmSearch | chronicle.googleapis.com/events.udmSearch |
| Search | ListAliases |
RPC (v1) | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
| Search | ListAssetAliases |
RPC (v1) | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
| Search | ListUserAliases |
RPC (v1) | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
| Uppercase Alerts | CreateCorrespondence |
RPC (v1) | N/A | Not needed (this endpoint is not available in the modern Chronicle API as it is no longer required). Note: Endpoint implementation was removed from Backstory in mid-2023. |
| Uppercase Alerts | GetUppercaseAlert |
RPC (v1) | LegacySearchFindings | chronicle.googleapis.com/legacies.legacySearchFindings. Note: Endpoint implementation was removed from Backstory in mid-2023. |
| Uppercase Alerts | ListUppercaseAlerts |
RPC (v1) | LegacySearchFindings | chronicle.googleapis.com/legacies.legacySearchFindings. Note: Endpoint implementation was removed from Backstory in mid-2023. |
Unmapped and removed endpoints
The following table lists the legacy API endpoints that are not mapped to the modern Chronicle API and are scheduled for removal, along with the business rationale:
| Feature area | Legacy API | Legacy method | Justification |
|---|---|---|---|
| Legacy RBAC | CreateSubject |
RPC (v1) | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | DeleteSubject |
RPC (v1) | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | GetSubject |
RPC (v1) | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | ListRoles |
RPC (v1) | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | ListSubjects |
RPC (v1) | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | UpdateRole |
RPC (v1) | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | UpdateSubject |
RPC (v1) | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Parser | ListCbnParserErrors |
RPC (v1) | No longer required or available in the modern parser management workflow. |
| Partner | EnableIAM |
RPC (v1) | Feature was already deprecated and is handled using standard Google Cloud mechanisms. |
| Partner | GenerateIamMigrationCommands |
RPC (v1) | Feature was already deprecated and is redundant in the modern architecture. |
| Partner | GenerateIdPMetadata |
RPC (v1) | Redundant in the modern Google Cloud-integrated architecture. |
| Partner | GetIngestionFilter |
RPC (v1) | Redundant in the modern Google Cloud-integrated architecture. |
| Partner | SetGCPProjectLink |
RPC (v1) | Redundant in the modern Google Cloud-integrated architecture. |
| Uppercase Alerts | CreateCorrespondence |
RPC (v1) | Feature was already deprecated. |
Need more help? Get answers from Community members and Google SecOps professionals.