SIEM API endpoint mapping
Supported in:
This document maps legacy SIEM API endpoints (Backstory API including Customer Management API, and Ingestion API) to their corresponding modern Chronicle API endpoints.
API mapping table
| Feature area | Legacy API method | Legacy API version | Chronicle API method | IAM permission required |
|---|---|---|---|---|
| BigQuery | UpdateBigQueryAccess |
v1 | ProvideBigQueryAccess | chronicle.googleapis.com/bigQueryAccesses.provide |
| CuratedRule | ListCuratedRuleDetections |
v2 | LegacySearchCuratedDetections | chronicle.googleapis.com/legacies.legacySearchCuratedDetections |
| CuratedRule | ListCuratedRules |
v2 | ListCuratedRules | chronicle.googleapis.com/curatedRules.list |
| LegacyAlert | UpdateAlert |
v1 | LegacyUpdateAlert | chronicle.googleapis.com/legacies.legacyUpdateAlert |
| Case | CreateOrUpdateCase |
v1 | LegacyCreateOrUpdateCase | chronicle.googleapis.com/legacies.legacyCreateOrUpdateCase |
| Data Export | CancelDataExport |
v1 | CancelDataExport | chronicle.googleapis.com/dataExports.cancel |
| Data Export | CreateDataExport |
v1 | CreateDataExport | chronicle.googleapis.com/dataExports.create |
| Data Export | GetDataExport |
v1 | GetDataExport | chronicle.googleapis.com/dataExports.get |
| Data Export | ListAvailableLogTypes |
v1 | FetchLogTypesAvailableForExport | chronicle.googleapis.com/dataExports.fetchAvailableLogTypes |
| DataTap | CreateDataTap |
v1 | CreateDataTap | chronicle.googleapis.com/dataTaps.create |
| DataTap | DeleteDataTap |
v1 | DeleteDataTap | chronicle.googleapis.com/dataTaps.delete |
| DataTap | GetDataTap |
v1 | GetDataTap | chronicle.googleapis.com/dataTaps.get |
| DataTap | ListDataTaps |
v1 | ListDataTaps | chronicle.googleapis.com/dataTaps.list |
| DataTap | UpdateDataTap |
v1 | UpdateDataTap | chronicle.googleapis.com/dataTaps.update |
| Feeds | CreateFeed |
v1 | CreateFeed | chronicle.googleapis.com/feeds.create |
| Feeds | DeleteFeed |
v1 | DeleteFeed | chronicle.googleapis.com/feeds.delete |
| Feeds | DisableFeed |
v1 | DisableFeed | chronicle.googleapis.com/feeds.disable |
| Feeds | EnableFeed |
v1 | EnableFeed | chronicle.googleapis.com/feeds.enable |
| Feeds | FetchFeedServiceAccount |
v1 | FetchServiceAccountForCustomer | chronicle.googleapis.com/feeds.fetchServiceAccount |
| Feeds | GetFeed |
v1 | GetFeed | chronicle.googleapis.com/feeds.get |
| Feeds | GetFeedSchema |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/feeds.listLogTypeSchemas |
| Feeds | GetLogTypeSchema |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/feeds.listLogTypeSchemas |
| Feeds | ListFeeds |
v1 | ListFeeds | chronicle.googleapis.com/feeds.list |
| Feeds | ListFeedSourceTypeSchemas |
v1 | ListFeedSourceTypeSchemas | chronicle.googleapis.com/feeds.listFeedSourceTypeSchemas |
| Feeds | ListLogTypeSchemas |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/feeds.listLogTypeSchemas |
| Feeds | UpdateFeed |
v1 | UpdateFeed | chronicle.googleapis.com/feeds.update |
| Forwarder | CreateForwarder |
v2 | CreateForwarder | chronicle.googleapis.com/forwarders.create |
| Forwarder | GetForwarder |
v2 | GetForwarder | chronicle.googleapis.com/forwarders.get |
| Forwarder | ListForwarders |
v2 | ListForwarders | chronicle.googleapis.com/forwarders.list |
| Forwarder | UpdateForwarder |
v2 | UpdateForwarder | chronicle.googleapis.com/forwarders.update |
| Forwarder | DeleteForwarder |
v2 | DeleteForwarder | chronicle.googleapis.com/forwarders.delete |
| Forwarder | GenerateForwarderFiles |
v2 | GenerateForwarderFiles | chronicle.googleapis.com/forwarders.generateFiles |
| Forwarder | CreateCollector |
v2 | CreateCollector | chronicle.googleapis.com/collectors.create |
| Forwarder | GetCollector |
v2 | GetCollector | chronicle.googleapis.com/collectors.get |
| Forwarder | ListCollectors |
v2 | ListCollectors | chronicle.googleapis.com/collectors.list |
| Forwarder | UpdateCollector |
v2 | UpdateCollector | chronicle.googleapis.com/collectors.update |
| Forwarder | DeleteCollector |
v2 | DeleteCollector | chronicle.googleapis.com/collectors.delete |
| Parser | ArchiveCbnParser |
v1 | DeactivateParser | chronicle.googleapis.com/parsers.deactivate |
| Parser | CreateCbnParser |
v1 | CreateParser | chronicle.googleapis.com/parsers.create |
| Parser | GetCbnParser |
v1 | GetParser | chronicle.googleapis.com/parsers.get |
| Parser | ListCbnParserHistory |
v1 | ListParsers | chronicle.googleapis.com/parsers.list |
| Parser | ListCbnParsers |
v1 | ListParsers | chronicle.googleapis.com/parsers.list |
| Parser | RetrieveSampleLogs |
v1 | ListLogs | chronicle.googleapis.com/logs.list |
| Parser | ValidateCbnParser |
v1 | CreateParser | chronicle.googleapis.com/parsers.create |
| Partner | CreateCustomer |
v1 | CreateTenant | chronicle.googleapis.com/tenants.create |
| Partner | GetCustomer |
v1 | GetInstance | chronicle.googleapis.com/instances.get |
| Partner | GetForwarderConfigs |
v1 | GenerateForwarderFiles | chronicle.googleapis.com/forwarders.generateFiles |
| Partner | ListCustomersOfPartner |
v1 | ListTenants | chronicle.googleapis.com/tenants.list |
| Partner | SetAuthVersion |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
| Partner | SetComplianceRequirements |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
| Partner | SetUIState |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
| Partner | SetWorkforcePoolProvider |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
| ReferenceList | CreateReferenceList |
v2 | CreateReferenceList | chronicle.googleapis.com/referenceLists.create |
| ReferenceList | VerifyReferenceList |
v2 | VerifyReferenceList | chronicle.googleapis.com/referenceLists.verify |
| ReferenceList | GetReferenceList |
v2 | GetReferenceList | chronicle.googleapis.com/referenceLists.get |
| ReferenceList | ListReferenceLists |
v2 | ListReferenceLists | chronicle.googleapis.com/referenceLists.list |
| ReferenceList | UpdateReferenceList |
v2 | UpdateReferenceList | chronicle.googleapis.com/referenceLists.update |
| Retrohunt | RunRetrohunt |
v2 | CreateRetrohunt | chronicle.googleapis.com/retrohunts.create |
| Retrohunt | ListRetrohunts |
v2 | ListRetrohunts | chronicle.googleapis.com/retrohunts.list |
| Retrohunt | GetRetrohunt |
v2 | GetRetrohunt | chronicle.googleapis.com/retrohunts.get |
| Retrohunt | CancelRetrohunt |
v2 | CancelOperation | chronicle.googleapis.com/operations.cancel |
| Retrohunt | WaitRetrohunt |
v2 | GetOperation | chronicle.googleapis.com/operations.get |
| Rule | GetRule |
v2 | GetRule | chronicle.googleapis.com/rules.get |
| Rule | CreateRule |
v2 | CreateRule | chronicle.googleapis.com/rules.create |
| Rule | VerifyRule |
v2 | VerifyRuleText | chronicle.googleapis.com/rules.verifyRuleText |
| Rule | ListRules |
v2 | ListRules | chronicle.googleapis.com/rules.list |
| Rule | DeleteRule |
v2 | DeleteRule | chronicle.googleapis.com/rules.delete |
| Rule | ArchiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | UnarchiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | EnableLiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | DisableLiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | ListRuleVersions |
v2 | ListRuleVersions | chronicle.googleapis.com/ruleVersions.list |
| Rule | CreateRuleVersion |
v2 | CreateRule | chronicle.googleapis.com/rules.create |
| Rule | EnableAlerting |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | DisableAlerting |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rule | ListDetections |
v2 | LegacySearchDetections | chronicle.googleapis.com/legacies.legacySearchDetections |
| Rule | GetDetection |
v2 | LegacyGetDetection | chronicle.googleapis.com/legacies.legacyGetDetection |
| Rule | StreamDetectionAlerts |
v2 | LegacyStreamDetectionAlerts | chronicle.googleapis.com/legacies.legacyStreamDetectionAlerts |
| Rule | StreamTestRule |
v2 | LegacyTestRuleStreaming | chronicle.googleapis.com/legacies.legacyTestRuleStreaming |
| Rules | CreateRule |
v1 | CreateRule | chronicle.googleapis.com/rules.create |
| Rules | GetRule |
v1 | GetRule | chronicle.googleapis.com/rules.get |
| Rules | UpdateRule |
v1 | UpdateRule | chronicle.googleapis.com/rules.update |
| Rules | DeleteRule |
v1 | DeleteRule | chronicle.googleapis.com/rules.delete |
| Rules | EnableLiveRule |
v1 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
| Rules | ListResults |
v1 | LegacySearchRuleResults | chronicle.googleapis.com/legacies.legacySearchRuleResults |
| Rules | ListRules |
v1 | ListRules | chronicle.googleapis.com/rules.list |
| Rules | RunRule |
v1 | CreateRetrohunt | chronicle.googleapis.com/retrohunts.create |
| Alerts | StreamDetections |
v1 | StreamDetectionAlerts | chronicle.googleapis.com/legacies.streamDetectionAlerts |
| Alerts | StreamRuleNotifications |
v1 | StreamDetectionAlerts | chronicle.googleapis.com/legacies.streamDetectionAlerts |
| Search | FetchUdmSearchView |
v1 | LegacyFetchUdmSearchView | chronicle.googleapis.com/legacies.legacyFetchUdmSearchView |
| Search | GetEvent |
v1 | GetEvent | chronicle.googleapis.com/events.get |
| Log | GetLog |
v1 | GetLog | chronicle.googleapis.com/logs.get |
| Search | ListArtifactAssets |
v1 | FindRelatedEntities | chronicle.googleapis.com/entities.findRelated |
| IOC | ListArtifactIoCDetails |
v1 | LegacySearchArtifactIoCDetails | chronicle.googleapis.com/legacies.legacySearchArtifactIoCDetails |
| Search | ListEvents |
v1 | LegacySearchAssetEvents | chronicle.googleapis.com/legacies.legacySearchAssetEvents |
| IOC | ListIoCs |
v1 | ListIocMatches | chronicle.googleapis.com/iocMatches.list |
| Search | SearchRawLogs |
v1 | SearchRawLogs | chronicle.googleapis.com/rawLogs.search |
| Search | UdmSearch |
v1 | UdmSearch | chronicle.googleapis.com/events.udmSearch |
| Search | ListAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
| Search | ListAssetAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
| Search | ListUserAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
| Uppercase Alerts | GetUppercaseAlert |
v1 | LegacySearchFindings | chronicle.googleapis.com/legacies.legacySearchFindings. Note: Endpoint implementation was removed from Backstory in mid-2023. |
| Uppercase Alerts | ListUppercaseAlerts |
v1 | LegacySearchFindings | chronicle.googleapis.com/legacies.legacySearchFindings. Note: Endpoint implementation was removed from Backstory in mid-2023. |
| Ingestion API | BatchCreateEntities |
v2 | ImportEntities | chronicle.googleapis.com/entities.import |
| Ingestion API | BatchCreateEvents |
v2 | ImportStatsEvents | chronicle.googleapis.com/forwarders.importStatsEvents |
| Ingestion API | BatchCreateLogs |
v2 | ImportLogs | chronicle.googleapis.com/logs.import |
| Ingestion API | BatchCreateUDMEvents |
v2 | ImportEvents | chronicle.googleapis.com/events.import |
| Ingestion API | BatchCreateUnstructuredLogEntries |
v2 | ImportLogs | chronicle.googleapis.com/logs.import |
| Ingestion API | CreateEntities |
v1 | ImportEntities | chronicle.googleapis.com/entities.import |
| Ingestion API | CreateUDMEvents |
v1 | ImportEvents | chronicle.googleapis.com/events.import |
| Ingestion API | CreateUnstructuredLogEntries |
v1 | ImportLogs | chronicle.googleapis.com/logs.import |
| Ingestion API | ListLogTypes |
v1 | ListLogTypes | chronicle.googleapis.com/logTypes.list |
| Ingestion API | ListSupportedLogTypes |
v2 | ListLogTypeSettings | chronicle.googleapis.com/logTypeSettings.list |
| Ingestion API | PutLog |
v1 | UpdateLogType | chronicle.googleapis.com/logTypes.update |
For more information about migrating from the Ingestion API to the Chronicle API, see Chronicle API ingestion methods.
Unmapped and removed endpoints
The following table lists the legacy API endpoints that are not mapped to the modern Chronicle API and are scheduled for removal, along with the business rationale:
| Feature area | Legacy API method | Legacy API version | Justification |
|---|---|---|---|
| Legacy RBAC | CreateSubject |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | DeleteSubject |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | GetSubject |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | ListRoles |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | ListSubjects |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | UpdateRole |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Legacy RBAC | UpdateSubject |
v1 | Obsolete; access control is now governed by granular Google Cloud IAM roles. |
| Parser | ListCbnParserErrors |
v1 | No longer required or available in the modern parser management workflow. |
| Partner | EnableIAM |
v1 | Feature was already deprecated and is handled using standard Google Cloud mechanisms. |
| Partner | GenerateIamMigrationCommands |
v1 | Feature was already deprecated and is redundant in the modern architecture. |
| Partner | GenerateIdPMetadata |
v1 | Redundant in the modern Google Cloud-integrated architecture. |
| Partner | GetIngestionFilter |
v1 | Redundant in the modern Google Cloud-integrated architecture. |
| Partner | SetGCPProjectLink |
v1 | Redundant in the modern Google Cloud-integrated architecture. |
| Uppercase Alerts | CreateCorrespondence |
v1 | Feature was already deprecated. |
Need more help? Get answers from Community members and Google SecOps professionals.